Full text of "ENIGMA newsletters 1993-2000"

See other formats

E.N.I.G.M.A

EUROPEAN NUMBERS INFORMATION GATHERING &
MONITORING ASSOCIATION

Published July 1998 ISSUE 1 5

IN THIS ISSUE OF ENIGMA

°F/&lci)IE» TBftMSMITTgR SIT i LOCATED 1
EE §HiP§ U®Ht ©M mm HR

fcaNTLE^BN, Thebe'? ft
fPY* IN yuPS'T.I

OUR ADDRESS : (SI ENIGMA

17-21, CHAPEL STREET,
BRADFORD, WEST YORKSHIRE,
* BD1 5DT, ENGLAND

VIA E MAIL : — <p — <enigma.box@centrenet.co.uk>

VIA FACSIMILE : « UK: 01274-779004

OVERSEAS: 1 +44 1274- 779004

^ INTRODUCTION

ENIGMA is the journal of the European Numbers Information Gathering and Monitoring Association,

ENIGMA is a non-profit making association of listeners who monitor and gather information on
"Number Stations” and other related radio transmissions. ENIGMA aims to bring together listeners
and enthusiasts and provide quality information on subjects not normally available from main-stream
publications. In addition to our dedicated private readership ENIGMA is also purchased by
Government agencies and oveiseas Embassies and Security Services.

We aim to bring you the most accurate information available. The newsletter covers the preceding 3/4
months monitoring so is always "up to date" wisest published, but due to the nature of the subject,
schedules, operating patterns and habits are subject to change without notice!

^ CONTRIBUTIONS

We appreciate all contributions to the newsletter, especially from Europe, the Middle East, Far East &
CIS, but all are welcome (including anonymous information). We regret that owing to the amount of
information received we are not always able to provide a personal reply but, rest assured, we read,
collate and index all information for present and future use. What may seem insignificant today may
prove invaluable at a later date. Questions are mainly answered via our "Letters to ENIGMA" pages in
the Newsletter. ENIGMA is also a discussion forum and we welcome comments about the newsletter,
and "Numbers" monitoring in general.

& HQW YOU CAN HELP ENIGMA

In addition to your logs and letters we also collect ’cuttings’ and information about espionage for use
in features. We need more Morse monitors and also readers who would be interested in concentrating
on particular stations, either voice or Morse in order to leant more about their habits’. We are
particularly keen to leant about transmitter sites in any country. If you are going on holiday please let
us know what you heard, and if you are interested in writing a feature please contact our office.

^► SUBSCRIPTIONS

Four copies of ENIGMA are available for; GBP 6.00 UK Postage Paid

GBP 10.00 Rest of World, Air-Mail

Payments may he made by Sterling cash, US Dollars cash, Eurocheques or AMEX cheques (in
Sterling), UK cheques or Postal Orders. Payable to "ENIGMA"

^ BACK ISSUES

Back copies of issues 9 to 14 inclusive are still available, while stocks last, at the following prices,
inclusive of postage. Please allow up to 28 days for delivery. Issues 1 to 8 please enquire before
ordering stocks are very low.

UK Ov er seas

Issues 9 to 14 each 1.50 GBP 2J5Q

^ACKNOWLEDGEMENTS

information in ENIGMA may be reproduced, but please mention ENIGMA and if possible the
originator of the article. We would appreciate any cuttings in which ENIGMA is mentioned.

^ CONTRIBUTION DEADLINE

We aim to publish the next edition of ENIGMA in December 1998. Contributions would be
appreciated by Saturday 14th November. Thank you.

^ COVER ISSUE 15

Illustration - 'Trouble with the Swiss Guards at The Vatican". See News Round Up.

STATION NEWS

As announced in the last issue, the new combined Morse/voice reporting system is
now being used. As a logical extension of this, stations will now be listed according to
family (if known) rather than language/Morse. We will still use the same ENIGMA
reference numbers, but now they will be listed under their respective family headings.
To distinguish one family from another we have named them as far as possible after
their country of origin, and given them each a number - in Roman numerals.
(Individuals, or stations with no known family relationship are given the notation 'O’ -
and can always be allocated to a family at a later date if necessary).

Many of you, being used to the old system, may object to these radical changes, but
in time we hope you’ll see the advantages of being able to gauge more clearly the
overall activity of particular agencies. Many of our members find it difficult to relate
one station with another in the same family. Many stations also share habits with
other family members. We arc convinced that, once acquainted with this new system,
numbers stations will be better understood and more easily found.

Known families

Only families/stations active at present arc listed here. For fuller information see our
Control List

I a

CIS

M14 (incl.M24) E6 E17? G6 S6 V6 // S25

CIS

M12 E7 G7 S7 V7 // XP

USA

E5 V5

III

'Strich’

M3 Ell Gil S12

Germany E16 G16

VII

N Aida ?

El? M17?

VIII

'YT

M53?

IX a

Czech

MIG S1G>// M7

Czech

S17

Czech

M39 (a one-off: may be IXa,c or neither)

British

E3 E4

XI 'Swedish Rhapsody’ M4 // E23

XII Arabic E9 V8

XIII '3 note oddity’ Hungary M29 G4

XIV 'Ml family’ Ml M45 S21

XV 'Edna Sednitzer M13 E18 G22

XVI Romania? M63? (A2A)

XVIII Cuban M8 V2

XIX France M16//M51

(// indicates that the following station is not a direct equivalent of those preceding)

0 Ml 8 M21 M22 (4XZ Israel) M23 M26/34 M42 M52 M56 MX
E10 El 5 S13 S14 S28 V9 V13 V15 V20 V21 X6 XC XF XM XX

Other (rarer) stations in category 0 - especially Morse - are likely to be active. Major

losses over the past year have been the whole of Family IV (E12/M2), the sub-Family
IXb (OLX), and what seems to be the last of Swedish Rhapsody, G2 - of which more
later.

The station news which follows isn’t as detailed as we would wish it to be. This is due
to a backlog of schedule information which still needs processing. As usual, all we do
is give an idea of the level of activity. Please don’t write in and say that there aren’t
enough frequencies and times listed. The reasons are, as we’ve said before: 1. Many
stations simply don’t lend themselves to this approach - they don’t behave like
broadcast stations. 2. Many schedules running at present will be out of date by the
time you read this. It is up to monitors to keep track of these. This is what we have
to do. It’s not always easy, but once the habits of a station are properly understood it
usually presents no great problem. 3. Some stations’ schedules don’t follow
predictable cycles, so it’s a matter of luck when a new one is found. 4. The booklet
should help a great deal in the understanding of Numbers Stations. 5. We don’t
intend to repeat the same information from one issue to the next, as there is far too
much of greater importance to cover.

Lastly, the aim of ENIGMA is not primarily to publish 'times and frequencies’ - even
if it were easier to do so. Our aim is to investigate Numbers Stations from every
angle. In this way we differ from the run-of-the-mill 'utility/broadcast listing’ style.
We serve a wider readership than merely hobbyist shortwave listeners. Such SWLs
expecting to be told just when and where to locate particular numbers stations,
however, are unlikely to find information of comparable quality in any other
publication.

* ******** ********************* ** ********* *********************

This is our first attempt at using this new system, and it is by no means perfect yet.
In the next issue it is our aim to have all the station information fully integrated.
Apologies for the teething problems.

FAMILY I - Note. This is a very large family. Full details of its activity would fill
this newsletter. Transmissions are tailored to the recipients’ requirements and
schedules are very flexible. Many are weekly, some week-of-month, some monthly.
Some schedules are inter-related, and share the same messages at times. The
information given below is very brief, and not complete. A series of features on this
family is really needed, but due to lack of time we don’t know when this will be.
Collating logs, unravelling schedules and traffic analysis is very time consuming. A
few pages of results don’t obviously reflect the many hours of preparation. These
comments apply to many other stations also.

FAMILY la

Tire big news concerns S25. After years of daily transmissions these have now been
reduced to weekly - on Mondays only. Same schedule (615): 0800 14890kHz, moving
at 0820 to 11270kHz. Also, the complex variant formats, S25A & B, have not been
heard for a year now. Presumably the reduction in operation means that 'messages’
of S25 are less urgent, or that the number of recipients has been much reduced.

Does one 'message’ serve for the whole week now?

M14 - Some schedules this year so far: 143 168? 177 202 203 311 325 362 396 412 464
491 (slow MCW) 494 ?514 517 541 560 571 591 631 633 738 786 863^ Interestingly,
203 never includes null messages, and is a much longer schedule than most, having
been running since February, and still here. This one transmits Wed & Thu 1800 &
1900 - the latter time being on a lower freq. - a common feature of Ml 4. New
message each week, three repeats. Schedule numbers (IDs) in this subfamily are
time-dependent only - not freq.-dependent. Most lb schedules are both.

Two of the above, 464 & 863, use the five spaced zero ending, pausing between each
zero, (once known as M24) The reason for this is unknown. Schedule 560 always
seems to send double messages. Here are its DK/GCs recently: 1st May
319/82,422/61; 15th May 438/71,439/72 (is this a joke?!); 22nd May 349/71,891/72; 5th
June 143/70,981/72. Only the 1st May transmission seems realistic. Note the very
similar GCs, and those transposed DKs 439-349,891-981, and consecutive DKs 438/439.
What on earth is going on here? Perhaps it’s all to stimulate speculation within the
monitoring agencies!

E6 - Schedules so far: 129 194 204 206 237 284 291 295 308 314 320 394 471 478 482
506 592 609 614 641 682 683 702 709 715 735 738 821 ?825 843 856 915 ?946. 715
has been running all year so far. Best times: 18-2200 all days of week.

E6B - (NEW DESIGNATION) A new variant ‘format was logged on 5th February
with call beginning at 2040 on 3820. "129 129 129 7432t>'' At 2044: "573 573 24 24’
then 24 x 5F as usual, 2573 573 24 24", then "129" repeated for about a minute, and
"308 308 16 16" and 16 x 5F message, ending 308 308 16 16 00000 as usual. A double
message on schedule 129 (a one-off schedule?), but what does the 5f call group
represent?

?E17 - Not often logged in Europe due to its preference for the early hours of the
morning Sparse logs include: Mon 0200 7775, Mon 0410 7944, Fri 0200 5208, Fri
0300 4518, Sun 0400 6250, Sat Q700 7035 - in amateur band. Although E17’s format
is identical to the others in this subfamily, its habits (including scheduling) and
technical quality are quite different. All other family members are noted for their
reliability and excellent transmission quality. ID s this year: 167 247 989 ???.

G6 - Schedules so far processed: 076 907 Best times: Mon 19/2000 , 1900 & 2000 1st
MON & TUE of month. One monthly message, three repeats. Has also been
reported on SAT. This and V6 are the least busy of la stations.

S6 - Schedules so far: 102 163 254 385 432 482 502 621 624 659 714 719 ?726 731 826
842 852 971. Best times: Mon 21-2230, Tue 18-2130, Wed 1630-21, Thu 2000, Sat
0900 & 1800, Sun 0500 & 2100.

A very strange-sounding S6 appeared on Tue 7.4 2100 on 5125kFIz: 971-472/30,
repeating at 2200 on 4504kHz. Throughout both transmissions there was a rythmic
scratching noise keeping time with the groups. The first tr. ended with only three
zeroes - an error. The second tr. ending in the usual five. About 20 seconds later

the scratching stopped leaving a clean carrier. Technical faults are almost unknown
on the Russian stations. The scratching was most probably caused by a drum
recorder, which for some reason was brought back into service.

S6C - A few of these oddities have popped up. e.g. TUB 14th April at 0535 on
7590kHz: "11715". No pattern to these transmissions has yet been identified.

S25 - See above.

V6 - Schedules processed so far: just one and a 'missed ID’, 728 ??? FRI 1900 The
least active of Family I stations, but still running at least one regular schedule.

FAMILY lb

M12 - Still the busiest of all the Russian stations with many schedules running. Some
of these are 'special’ schedules which don’t conform to the usual habits of this
sub-family. The main ones of which are 658 & 749 (which are linked), 963 which has
a long-term frequency use and until recently, a nonstandard repeat pattern, and also
the very long-running schedule sending the same message every week but changing its
schedule number and frequencies at seasonal intervals.

Many schedules in morse and voice have long been noted to use frequencies in which
the primary, and each of the two repeats are related - the 10kHz & 1 kHz placings
being the same. e.g. 13367-12167-11567. This example being June’s special M12
schedule sending the very long-running 66 group message (DK always 792). For the
June freqs. the SN is 315 - these three digits representing the 100kHz placings for the
three freqs., i.e. 13367-12167-11567. Many other schedules use the same ID structure,
so that once the primary freq. schedule is identified, the other two freqs. can be
found easily. This is only the second case where we’ve noted frequency-related IDs
being used - the other being where M45/S21 schedule numbers represent the last
three Figures (100/10/1 kHz) of the lowest parallel.

Some schedules operating this year include: 135 138 151 152 154 194 213 217 234 286
287 304 326 366 416 418 426 486 595 608 691 715 719 724 754 767 772 782 812
815(linked to 658/749) 825 845 870 935 936 940 941 945 946 963 949 986

The endlessly repeated 792/66 message has changed schedule several times as usual -
to enable best reception at its target location/s (1940-2000-2020UTC Sun, changing to
18401900-1920 for summer months) Dec/Jan Sched No.: 304, Feb: 782, Mar: 213, Apr
& May: 151, Jun: 315 - freqs being 1 3367-1 21671 1567.

658 - Tue Wed 1400-1420-1440 on 13921-15720-14922?

Mon Tue 1800 & 2100 on 6855-5790-4627

Wed 2000 on 6934

Sat 2000 & 2100 on 6855-5790-4627

749 - Mon Tue Wed Thu Sat Sun 1600/1700 on 6782-7657-8171kHz

These two schedules are interrelated and operate in a complex manner; they really

need a feature of their own.

E7 - see also M12. Some Schedules logged this year include: 102 695 825 890 915
916 919 946 948. Try 2000UTC Mon, Wed & Sun

G7 - see also M12. Schedules this year include: 118 156 164 214 218 224 258 306 421
464 485 522 577 621 631 696. Try 0630 Tue & Thu, 1900 & 2030 Thu, 1800 Fri, 0800
Sat, 0700 Sun. Linked: 118/224 132/406 164/224 164/214 306/421 464/621 621/696

§7 - see also Ml 2. Schedules this year include: 350 369 418 571 638(including a
double message) 671 742 792 795 813 847 864 867. Tty 2030 MON, 0500 TUE &
THU, 2100 MON.

V7 - see also M12. Schedules so far this year: 118 275 398 541 572 654 725 749 893
947. MON 2000. FRI 2000. TUE & THU 0600 Messages rare, nearly always nulls.
Repeats follow normal family pattern. Jul 7 : 0600 11461-12061-1336 i?^ ^ in: 403

XP (Polytone) - As polytone frequencies always follow the 'last two digits rule’ (i.e.
10 & lkllz placings the same for primary and each repeat) does this mean that the
Schedule Number is related (see M12 above)? If so, this means that the tones could
all eventually be identified with their respective figures. This is assuming that tones
are not reallocated with each new schedule, which is possible. The 0, 1 & space tones
never vary, but the other seven may do - however, it is unlikely as this would involve
reprogramming the resolver at the receiving end. Such reprogramming information
would need to be passed to the agent in advance; there are many ways of doing this.
Seeing that GC tones are omitted, is this to prevent tone identification, or merely
because a GC is unnecessary when the message is being automatically recorded?
There is no way we can tell. As the message is encrypted anyway, there’s no reason
for tone identification to^kept secret, so there seems little point in reallocating
tones,unless it is merely to add another layer

June freqs.: FRI 0600 9394-11494-13394. Could the Schedule be 343? Also TUE
2100. July 0600: 9441-11041-12141kKz

All Family 1 schedules are subject to change, and need to be closely followed. Times
given are only very rough guides.

Signals usually very strong and of high quality.

FAMILY II See further details under this heading.

The CIA’s "Cynthia" (E5) and her much shyer Spanish sidekick

<V5)

Either Cynthia, or possibly her clone, have now taken over from the little German
girl’s voice of Swedish Rhapsody - see Family XI for details. Surely this can only
mean collusion of some kind between the two agencies.

As many schedules come and go without rhyme or reason, it is hardly worth
publishing details, as they become out of date veiy quickly. A very low GC of 34 was
noted on a 9th March transmission - this is very unusual for this station.

FAMILY III - "Strich"

Behaving in its usual predictable way. M3’s unpredictable 287 schedule has popped
up again - daily as always, and never sending a message - at present at 1630 on 7256
in the 40m broadcast band, having moved from 5830kHz.

M3 - IDs operating this year: 010 Oil 012 013 015 016 017 018 019 / 035 / 040 041
042 043 044 ?045 046 047 7048 7049 / 214 215(error?) 216 / 287 / 496 (Gil also) /
503(slow) 7508 / 552 7503 7558 / 584 / 7621 624 / 741 742 743(MCW) / 976 ?m*

7 = possibly active. Too many schedules to list details, mostly 0600-1000, 4-6MHz.
Highest freq. at present: 10720kHz.

Special ID 121 has not been logged this time, but could easily have been missed, due
to its unpredictability. Messages sent at the usual levels, mostly in the usual periodic
flurries. Special ID 287 is back again. It may never go away, as freqs. and times are
very variable - DAILY as always, at present at 1630 on 7256kHz. 287 never sends
messages, but is associated with MSA variant: 111 or 333/00. Some of the above IDs,
also have never been known to send traffic, e.g. 214, 503, 624. Others rarely send
nulls, such as 015, which may send two different messages within an hour, on
different freqs. All message GCs over past 6 months have stuck rigidly between 5059,
which is typical. (Only 121 regularly deviates from this range).

Many of the schedules are following those of last year, but more significantly,
messages are, in some cases, repeating group for group, those sent at the same time
last year. E.g. TUE 2.6.98 0830 5550kHz: 015/54. The identical message was sent
using a different ID in 1997: 5520 012/54. On WED10.6.98 1030 5180kHz: 041/50.
The same message was sent on WED 11.6.97 on same schedule. Comments and
speculation please.

Ell - (231) is still around: FRI 2030 - 3060,4015,4780 or 5050 (depends on time of
year) Weeldy

Gil - (752) Weekly TUE 2100 - 3823,4015,4780 or 5050
WED 0800 - 6430,7840 and others - Repeat
(496) Weekly WED 0600 - 6750,7580 and others

S12 - (971) First and third MON of month 2100 - 3823,4465,51 so
First and third WED of month 2100 - 4015,5180
(755) Not logged this year. Lost? Not operating?

All these voice schedules have been running for years now and messages are rare.

FAMILY VI - This section follows later.

FAMILY VII

M17 - Much busier than its voice counterpart. All schedules still operating as usual.
A record 99 group message was sent on 22nd April, considerably higher than the
typical GC of around 22. Recently some messages have followed on from one week
to the next. No changes.

}

El ("Ready Ready!") - Only voice schedule operating appears to be 82 on Mon
2130-2150-2210: 4740-4460-4270kHz. Will this be the next to go? Catch it while you
can!

FAMILY VIII - M53?

The question mark says it all! We are not certain, but it is quite possible that M53
could be part of the family which once included the extinct/dormant S8 (YT) and
M27 (BTV). Several characteristics when taken together, support this suspicion: 1.

Very stable long-term schedules. 2. Use of only two known freqs. - 6820(Winter) &
8231(Summer). 3. Use of 3f random addressee numbers. 4. Low group counts typical
of YT & BTV messages. 5. Unnecessarily 'fussy’ call and preamble, making the most
of Morse procedure signals.

Can be heard most days at 2000 & 2100 on 8231kHz (since 31.3). Always uses the
same 'ID’ of 747, followed by one, or occasionally two, messages to different
addressees. Repeats are sent on the following day, and like S8 & M27, messages are
never 'carried over’ but are regularly replaced. A handkeved transmission was noted
on 3rd Apfd .

FAMILY IXa

M7 - No change in activity. IDs 035 078 701 771 966 - not easy to catch these due to
lack of call and only one minute of 'tone sequence’ before the preamble. For
automated reception.

M10 - Much easier to catch IDs due to 5min cail. As well asall the usual schedules
still operating as predicted, there have been some very odd goings-on in recent
months. Encrypted 5fig addressee numbers are being used for two anomolous
schedules: 1000 on 5705//? and 1900 on 3824kHz. The 1000 schedule is daily - a
departure from M10 habits. It also sends (short) messages to four addressees each
time - never repeating - new messages daily. At 1900 , “ irregular, Several days/week*

A peculiarity of both of these is that the 'circuit number’ is always 111 instead of the
usual 555, At * 900 the GC is sent three times (each time) instead of twice, making it a
variant format.

Regular schedules operating this year (in order of 1st addressee): 107/859 249/487
253 313 345 345/724 355/966 408/695 481/988 495/691 571/275/049/435 585/086
661/423 667/988 752/903 771 783/961 866/844 905/423 966 ?/859
All the above use two parallel freqs, one or both changing seasonally. Not all are
weekly. Some operate seasonal cycles, others are continuous such as:-

571/275/049/435 - weekly SAT 1645 4485//3385-5028kHz
Repeating on SUN, MON & WED. (same time/freq slot)

Some schedules repeat at different time/freq slots, a record 98 groups (903) on 21.4

at 1710.

S10t >- Regular schedule has been reduced to first (109) and third (247) Tuesday of

month: 109/541 & 247/541 are both still operating, sharing time/freq slots. Addressee
•^Transmissions are often Hand keyed , GC (always 30) repeated twice , not once. Tr
ends (DK x2) 30 30 30 - without the usual three zeroes. Therefore new variant, M10D.

541 is always included. Moved from 44B5//3833 for summer.

TUE & WED (Repeat) 0630 & 1530 - 4958/74485

A mammoth 132 groups was sent to 109 on 5th May.

FAMILY IXc - SI 7

Still operating as usual. Daily at 1355-1402 on 5027//4485. Long-term analysis of its
'messages’ is underway, and so far, has resulted in very interesting patterns. Details
will be published at a later date. In the meantime, logs of this station would be very
welcome - only daily 'message’ group required, as this is the only variable.

1X0: M39

Although definately one of the Czech family, it seems to be in a class of its own
hence the odd designation. Several pointers give away its family relationship: 1. The
use of rapid dashes between 'sections’ within its transmissions - a characteristic of
former M7/M10 transmissions, now largely dropped. 2. Use of parallel freqs. where...
3. one of its transmitters has a very distinctive clicking as if arcing is taking place in
the PA stage. This peculiarity has also been noted on one of MIO’s two parallel
transmissions. 4. Use of short zero. All these combined,

especially No 3, confirm its identity. Its format also follows that of SI 8 , one of the
rare 'Czech Man’ formats, which it may have replaced. If so, it is part of the
subfamily IXa, however, not enough is known about S18’s habits to be sure on this.
Scheduling provides no clues as M39 seems tooperate without one - both times and
freqs are found by chance. Logs, therefore, are always sparse, and true activity levels
will be higher than they appear. All we can say is that it’s still around with its usual
unfathomable format: 3fig x3 followed by 5f x3, none of which are entirely random.
Best times 0500-1 100, usually between 4 & 6MHz.

Has been active several times this year

FAMILY X - This section follows later.

FAMILY XI - "Swedish Rhapsody"

This station, noted for its stability, has recently undergone two radical changes.

On 1st April the old schedules were entirely replaced, turning the unruffled world of
Swedish Rhapsody upside-down. Perhaps the biggest change was the total extinction
of G2A, whose schedule hadn’t altered for very many years. In the third week of
April, all this changed again - this time, although the new schedules remained, the
familiar 'little girl voice’ along with her musical toy disappeared and has not been
heard since. Yet another blow to eccentricity which will be sadly lost. The voice in
German has been replaced by that of the brash American English - Cynthia. What
conclusions can we draw from this?

Format has also changed - after a short settling down period. Gone are the single
message voice transmissions; all are now of the 100/100/50 group triple type.
Transmissions commence at 3 minutes to the hour with a call reminiscent of E5,
however, no ID is included, and the counting is in the form of 5fig stutter groups, e.g.
Hill 22222 33333 44444 55555 66666 77777 88888 99999 00000 repeated until the

hour. On the hour the three message headers (still encrypted 5fig) are read out three
times, followed by the first header twice which is immediately followed by the first
message (100 pairs, as usual). Without pause the second header is read out twice,
and the second message follows immediately. The same applies to the third (50
group) message, which ends abruptly, although the word "END" has also been noted.
The main difference between this new format and the old one is the complete lack of
pauses and announcements (no English equivalent of "Achtung!") - from beginning of
traffic list to end of last message. Headers are read no differently as the message
groups themselves, as if they were merely message groups. This gives the impression
of one long 162 group message, which of course, it is not.

What does this imply? It now implies moreso that all three message blocks are
intended for the same recipients, and not separate addressees, as would be the case in
a station like M10, S10, G3 or G8 for example. It also implies that blocks 2 and 3 are
probably continuations (when needed) of the message encrypted in the first block.
This means that the third block would always be the least likely one to carry valid
traffic. The recipient would first of all transcribe the three headersas headings on a
pre-printed (?) form. A grid of 100 spaces (10 x 10) below the first heading would
then be filled in as the first block groups are read out. A prearranged Message End
Marker, say a particular run of 3 figures (in clear), would be looked for by the
recipient and at that point all further groups read out would be ignored, the receiver
being switched off. The headers probably provide decryption information, and
possibly also a (simply?) encrypted group count - in which case a Message End
Marker would not be needed. The message ending could be marked at the
appropriate grid square - these squares may even be numbered 1-150. Perhaps the
need for three blocks is due to a need (added security? An inherent weakness of the
system?) of the encryption system used, a system designed for a maximum of 100
groups. Why is the final block only half the length of the other two? Maybe it’s a
historical anomaly dating back to a period when time was needed to retune
transmitters in time for the commencement of the lOmin tone period prior to the
next transmission. A 100 group final block would leave very little time to arrange this.
50 groups ending at h + 37.5, would make all the difference; it could be as simple as
that. Maybe, for reasons unknown to the uninitiated, there is never any need for
more than 150 groups, and this figure depends on a very specific kind of message -
perhaps even so specific that precisely 100, 100 & 50 groups are always required, but
this seems the least probable theory. We are open to further suggestions and wild
speculations!

M4 - only one message per month, w/c 2nd Sat of month MON - 100 group msg at
0957 on 7250kHz. Repeated at: 1157 8188kHz, 1257 5748kHz; WED & THU - same
times and freqs as Mon. MCW constant carrier as before. Format is identical to
previous except that the lOmin of 'U’ now only lasts 3 minutes.

E23 (NEW DESIGNATION) - Three messages per month, each of 100/100/50GC
format:-

1. w/c 1st Sat of month MON, WED & THU - 0957 6507kHz, 1157 8188kHz, 1257
5340kHz - ali repeats of 0957 Monday. All USB.

2. w/c 3rd Sat of month MON, WED & THU - 0757 4832kHz, 0957 6200kHz, 1157

8188kHz, 1257 6507kHz - all repeats of 0757 Monday - 12 transmissions in all! All in
USB.

3. w/c 4th Sat of month MON, WED & THU - 0757 5340kHz, 0957 8188kHz, 1157
7250kHz. - all repeats of 0757 Monday. All AM.

"Fifth weeks’ now carry no transmissions. Note: transmissions have only been heard
on these three days of the week, and only during Central European office hours;
draw your own conclusions!

G2 - No longer operating.

FAMILY XII - This section follows later.

FAMILY XIII - VDE & "Three Note Oddity’

M29 (VDE) - M29A’s daily transmissions carrying weekly messages continue,
changing frequencies monthly. So do the longer format type (M29), but these follow
differentscheduling patterns. New message nearly always starts on Monday.

JAN

FEB

MAR

APR

MAY

JUN

1800:

3270

3910

????

1700:

6590

6640

6529kHz

2000;

3200

3470

5460

1900:

5709

????

6469kHz

M29

format

is more

often

heard

0700-0900.

Repeats 30min later 100kHz away,

Earlier in June there was a flurry of activity, e.g. THU 11.6 0700 5670: 23 35 11
0900=, 0800 5750: 9 38 11 1000=, 0900 6470: 19 35 11 1100=, 1800 5420: 26 38 11
2000= Purpose of first preamble element not known; 2nd is GC, 3rd is date, 4th is
time - UTC + 2. Often starts at h + lOmin, repeating at h + 40. (4th element would
then be xylO). July 1700 & 2000 slots: 6660-6509kHz

Numbers stations sometimes break their own rules and on 9th June M29’s expected
repeat 100 kHz lower down the band at 1030 didn’t materialise. In its place was G4
with its 3 note tuning signal, followed by 34 groups* The same thing happened on
11th June, an M29 at 1800 on 5420, was followed at 1830 by G4 on 5320kHz. A very
unusual feature of M29/G4 messages on this day were that they were ail made up of
seemingly random groups - apart from the first two groups, which were of the usual
type. * NOT repeat of M2 9 msg*

G4 (3 Note) - See also M29. Regular Sunday schedule continues. Messages change
monthly along with freqs. Other schedules seem to be less long-lived, and are harder
to pin down.

JAN FEB MAR APR MAY JUN
2105:3256 3265 4435 2005:4746 5410 5730kHz

2135:3156 3165 4335 2035:4646 5310 5630kHz

An analysis of messages has been undertaken, and will be published at a later date.
Although sending 'message blocks’, this clearly not a "text type’ station, and its form

( 2 .

of 'encryption’ is unique. The same applies to VDE.

FAMILY XIV

Ml - 'A’ network operating predictably with its usual six slots per week, however,
group counts have dropped from the regular 40, to between 30 & 40. 40s are actually
rare nowadays. The same trend has been also noticed on 'B’ network transmissions,
where often messages are very much longer than a particular schedule’s Standard GC.
e.g. 325 (SGC 30) has recently sent a 53 group message. The Standard GC 'rule’ is
no longer evident in many eases. Needless to say, we’ve no idea as to what this may
mean!

End-of-month transmissions follow their usual bewildering patterns. A promised
up-to-date EoM list has has to be delayed again, but wc can supply it on request.
EoMs certainly provide some interesting data. No EoMs were sent in June - just
ordinary messages, both of Thursday’s being longer than the recent average: 44 & 42
groups. Last year, the same thing happened in June - no EoMs. Perhaps this is their
holiday month!

'R’ Network schedules processed so far this year: 050 053 103 136 168 254 271 298
302 317 325 382 419 514 594 719 729 745 871 913 931 Like the 'A’ network these
are seasonal, but they all have their own cycles, e.g. 053 runs 7 months Aprii£>ctober,
and is replaced by 325, November to April. 419 runs Nov-Feb, replaced by 271,
Mar/Apr & Sep/Oct, and by 871, MayAug. Each schedule has its own freqs. Some
use two parallels.

Unlike the 'A’ Network which sends six different messages weekly - never repeated -
'B’ stations will often carry over a message for several weeks, and may even share the
same messages over roughly the same periods. This applies only to Related
Schedules, e.g. 136, 419 & 514 are related - for most of February they shared the
same message: 710/45. Previous to this they shared 517/43 (compiled on 12.1). 136
actually started sending this on the 12th, 514 on 15th, yet 419 was still sending an
earlier message (compiled 8.12) until 23rd Jan - leaving only 2 weeks for the 517/43
message. Operation of Ml in all its aspects is extremely complex, and considering
transmissions are hand-keyed, and certainly live in many cases, this makes it the most
highly-organised family of them all.

MIC has been active - as always highly unpredictable. It seems to use its own very
large selection of IDs - they can hardly be termed Schedule Numbers, as no regular
schedules exist.

M45 - Still only paired with one S21 schedule. At present TUE & THU 1702
5074//5474 Schedule Number being always now the last three figures of lowest freq.
i.e. 074 For the time being 1st groups are random.

S21 - Operating at least three regular schedules:

TUE & THU 1742 4973//S373 SN: 973. Repeats M45 message.

THU 1945 5290 Long-standing SN: 491

WED 2045 3160 Long-standing SN: 402

The 1742/1842 TU E/THU 'slot’, which once remained unchanged for years, is now
subject to frequent change:

JAN/FEB 323 MAR/APR 454 MAY/JUN 973
1842: 3323//3S23 4454//4854 1742: 4973//5373kHz

Other rather elusive schedules have been noted: SAT 0815 5075//? (075) SAT 0915
4832/73384 (384) but these do n’t seem to be regular.

FAMILY XV

M13 - Schedules this year include: 158 (no longer A) 183 ?228 ?252 253 254 261 272
284 288 346 378 411 417 419 458 517 590 735(A) 714 732 915 946(A)

590 still sends its longer than average (for M13) messages - 50-60 GC lately. 272 has
now reached Serial No 205 (May) In March two messages were sent on 158, which
had dropped its 000(M13A) format - 168/29 & 169/20. We’ve also partly solved the
problem of where some of these IDs disappear to; they change Schedule Numbers
while continuing with the same Serial Number sequence. Groups or pairs of
Schedule Nos are related to one another and operate consecutively, clearly being
aimed at the same recipient/s. At present, we can only predict some of these
schedules a year in advance. More work is being done on this.

E18 - Still around, but we’ve not been as diligent in keeping track of it as we should
be! Last logged 12th March^OO (or 2310) 6464kHz. Monthly Schedule no. not
known. Monitors desparately^as usual, for this and many other stations/schedules.
The more of you who contribute, the more we can publish. There’s a strict limit on
the amount of material that ENIGMA HQ and a few stalwarts can provide. We need
much more active support - and will give advice when needed.

G22 (RE-ACTIVATED) - Has been reported in recent months. Along with E18,
these voice stations are far less active than their Morse counterpart, and tend to
appear at 2200-0000 or 0400-0600. Frequencies change monthly.

FAMILY XVI - Romanian

M63 - The mysterious non-registered bogus callsign A2A is strongly suspected to be
operated by Romanian intelligence, but as yet, very little is known about its activity.
It seems to favour the lower freqs. - 3/4MHz region. Please send in all logs.

FAMILY XV1H - Cuban?

These very busy stations, presumed to be Cuban, do not all operate from Cuba, or at
least this is what signal strengths in Europe imply. Best times for Europe: 0000-1100

M8 - See last issue for reasonably full details.

V2 - See above. As mentioned before, the final figure in the 5fig header always
refers to the repeat number, e.g. 2 = 1st repeat, 3 = 2nd repeat. Thereare always
two repeats of any message’s first transmission. However, recently a header ending in
4 appeared. Was this an error? Compilation errors, at least as far as we can tell, are
non-existent. Unfortunately, we have no logs of the companion 1st, 2nd & 3rd
transmissions, so we cannot verify this. The original (non 150/150/150 group) format
is still being used but is only occasional, and seems to be more often logged in USA,
than in Europe.

Minor "cosmetic’ schedule changes do take place. When we have time, we hope to
analyse the vast quantity of data we hold on these stations.

FAMILY XIX - French intelligence

M16 (8BY) - Usual hourly transmissions. See previous issues for details. A "list’ as
opposed to "text’ type station.

M 51 - Usual level of activity for very long unbroken periods. One of the busiest
stations, yet its scheduling is, so far, impossible to penetrate. Listing frequencies
heard would be pointless. (4-6MHz region) Any time, any day.

0: STATIONS NOT ALLOCATED TO FAMILIES

By far the most active of these are the vast E10 (Phonetic alphabet - NATO-style)
network, its "pre-NATO’ style rival E15 and the inscrutable shape-shifting M23. This
section also includes The Buzzer (S28) and various miscellaneous Oriental and Morse
stations

Ml 8 no change.

M22 -4XZ no change - as far as we know.

M23 - See feature in this issue. See also M52 for a possible family link. As
amorphous and frustrating as ever. Suspicions that an embryonic family is on the
road to fruition, are getting stronger - see M52. This year has seen much perplexing
activity. We can only list the highlights.

First, the "non-news’. The "579’(null) schedule is still operating twice daily, and has
been doing so ever since Februaiy last year, without a single message being sent.
DAILY 0800 & 1400: 8307//9285kHz as we keep on reminding you!

The frantic daily activity on 6999 has ended, along with somewhat less frantic, but
related activity on 6430. No doubt they will be back. Various other (odd/even type)
shorterlived schedules have been and gone. Most notable, though, is the daily
(almost) schedule at 1500(summer, 1600 winter)

on 7795. A most extraordinary sereies of transmissions which often repeat a day’s

message on the same day the following week, for up to eight weeks on a run.
However, they went 'out of sync’ a while ago when a new Sunday schedule appeared
(once only) but it doesn’t seem to put them off. This is an 'even ID only* schedule,
where messages are always sent, (longest 129 GC). But, unlike the usual Odd/Even
format, this one uses a different even 3fig ID for each message. Even more bizarrely,
this schedule uses long pauses between elements. After the call, it is easy to imagine
the transmission has stopped, similarly at the message end. Timekeeping isn’t a
strong point - starts within 5min of nominal start time.

M26 & 34 - When they’re around - impossible to miss. However, this isn’t a very
frequent event, so logs are always sparse. An M34 sample: Mon 2.3 0820 5040 - "11
27" repeated 5min - "11 11 11" then 13 x 5f. Message repeated, then "21 27 27", and a
different 13 group message & repeat. (Not entirely random) Ends abruptly with last
message group.

M52 - A 'control’ type station. This rarity popped up on 6thFebruary 1700
4060//3835 with "34:383622 383622 383622 AR". At 1800 changed to: "34:4914 44
491444 491444 AR" until at least 2020. Again, on 29th June at 2000 on 7940//? For
the first time we can provide details of the 'call’ for it does have one. As traffic is of
the endlessly repeating type it was assumed that a call would be unnecessary.
However, its operators evidently don’t think so, for until 2012 it was sending a
repeated '55’. After a pause, this was followed by '10:441589 441589 441589 AR’
(pause) This was repeated continuously until at least 2115. As this station tends to
send 'flurries’ of transmissions interspersed by long periods of inactivity, when heard,
it is always worth searching for it over the next few days. Not surprisingly, it turned
up again on 1st July ending at 1802 with '14:824393:26 AR 14:’, ending abrupt, just
like that, in mid-flow. It was there again at 2110 sending,' 14:832233 AR’.

More and more I suspect the master hand of M23 here, for M52 carries some of its
idiosyncratic hallmarks. 1. Use of two parallel freqs. 2. Use of long zero. 3. The now
revealed call. M23 has in the past used similar calls, such as 33 or 44. Only one
other Numbers station uses two figure calls: M26/34. 4. Possible poor timing, when
'message’ was intended to begin at 2010? This is typical M23 - not noted for its
punctuality. In this case M52 probably started calling at 2002. 5. Use of the colon,
very rarely used in Morse nowadays, and a British trademark (!!). M23 also uses this
from time to time. 6. A suspiciously similar form of keying. We’ll say no more at
this point, except that all logs are veiy welcome.

M56 - very infrequent. No reports.

MX - Single Letter Transmissions No great changes to report. All the clusters busy
as usual, except 3595, closed for the season (?). The solitary R on 3323 went on one
of its mad excursions for a while to 6642kHz. When it returned it was on 3321, not
3323 - exactly half of 6642. Why? And why does it spend holidays in the 6MHz
band, while its clones on 3196 and 4325 stay behind? This is the same wandering
SLT which emigrated from 7452 a few years ago, where it had been for several years.
4MIIz+ is a big jump at these frequencies. My favourite, L, still has its chirp; it
wouldn’t be the same without iti

We were amused but not surprised by a comment in March 'Monitoring Times’ made
by Hugh Stegman: (referring to the 8492 cluster) "These are single-letter channel
markers for Russian Navy data or telemetry channels. They tend to cluster dose
together in frequency". They are emphatically NOT what he says, as evidence so far
is totally lacking. By repeating ad nauseum the same rumour it begins to stick and
become irrefutable dogma. It is part of Numbers Station folklore, like that
unforgettable classic "snowfall figures on Andorran ski-slopes" - so fantastic that it
never caught on. Being more credible, the SLT myth is still doing the rounds. We
could give other examples of this phenomenon too. BEWARE OF
DISINFORMATION. Until any information we receive can be independently
verified, we must treat it with caution, and notbe afraid to use the words, 'maybe,
likely, possibly, probably’ etc. or 'we have been informed that’. We can confirm that
certain individuals do feed ENIGMA with disinformation, (either cranks or pawns of
the intelligence world) and sometimes we lay traps for them and sometimes they fall
into them quite unwittingly.

"They tend to cluster..." This is a generalisation. We cannot treat all as one. Only
some SETs cluster. They play a very different role to other types which don’t, and
are possibly completely unconnected. It is interesting that in an email from Anatoly
Klepov listing Russian utilities contributed by Russian monitors, many stations are
listed as Russian naval, but the four SLTs listed (different monitors) are merely
named ' RUS SLHFM’. At least, it would seem, the Russians don’t follow like sheep!
See article in last issue.

Since that article, we have leamt of other cluster SLTs, inaudible in Europe. Takashi
of Japan has logged the following: Band B - E,F,K,V Band C - C,F,K,M,P,S Band D
- C,F,K,P Band E - C,F,P,S Band F - C,F,K,P,S Bands G & H - C,F,P,S. So
possibly there are up to seven SLTs in each cluster. In recent months solitary Vs
have been logged on 3316,4575 & 7002 (a new freq. - in amateur band). T has
appeared on 7527. It’s wise to be wary of T & E reports as they may not be sending
letters, but pips of some kind, and may not be SLTs at all. The E in cluster band B
seems a possible SET, though, by virtue of merely being where it is.

Another article is being prepared on these "Russian Naval Markers" - a vague and
meaningless term, for what are they marking but the passing of time?

FAMILY II - CIA

E5 COUNTING STATION 3/2F ENGLISH - Mode AM/SSB

See also important news of new designation E23 under Family XI ’Swedish
Rhapsody’. The 3/2F (E5) format is alive and well but traffic levels have fallen from
an all time high in autumn 1997. There have been many changes to the operating
schedule with each passing month, unlike last winter when things remained much the
same the all way through. Some long standing frequencies have been discontinued;
6970 kHz, which was used in the early evenings was a bad choice as it was usually
flattened by the Romanian Press Agency RTTY station. Another schedule to end is
the Sunday 16.00 transmission on 9070 kHz; this was one of the longest standing E5s
and has had several different parallel frequencies over the years.

We receive letters asking for us to publish the full schedule for E5. Unfortunately the
schedule does not remain stable enough. Please see further comments in Letters page
this issue. We will however look at collating those transmissions which are ’regular’
for the next issue and publishing these.

V5 COUNTING STATION 3/2F SPANISH - Mode AM/SSB

At one point it did appear that this format was in terminal decline in the Spanish
language but we have received some reports and the transmissions do seem to still be
active. Noted at 01. QQ 02.00 and 03.00 on TUE WED FRI & SAT.

FAMILY VI - BNP

El 6 - 2 LETTER - ENGLISH - Mode SSB

The active calls in English are ECHO HOTEL, BRAVO LIMA & ALPHA
UNIFORM. BL can be heard daily at 20.00 - noted using one of 11108 11545 or
11617. AU was again active on 4821//4888 in March. EH can be found on the higher
frequencies at either 15.30 or 16.00, noted on WED FRI & SAT.

G16 - 2 LETTER - GERMAN - Mode SSB

The active calls in German are GOLF KILO & WHISKY LIMA, GK is on several
times some evenings and was noted at 19.30 20.00 20.30 21.00 21.30 22.00 and 22.30,
several reports have also noted GK at 01.30 on TUE and SAT. Active GK calls
include 316 571 750 856 & WL calls have included 522 and 550. Activity from this
family is on the increase. Reports appreciated.

Frequency list for E16 & G16. 2690 2707 2745 3228 3262 4543 4594 (4821//4888 AU)
5015 5182 5732 5770 6370 6765 6853 7404 7532 7661 7740 7752 7858 8063 8173 9040
9325 9450 10170 10460 10500 10740 11108 11545 11617 12092 12210 12314 13362
13413 13752 13775 13890 14622 14945 15610 16055 16620 16414 17430 18195 18575
19295 19755 20240 20350 20675 22885.

Further news about 2 - letter stations in Simon Mason column this issue.

FAMILY X - MI6 SEE ALS0 PAGE 61 for new * evelatiotls
E3 ’LINCOLNSHIRE POACHER’ Mode SSB

Intensive jamming from Iran seems to have finally made some impact on LP
transmissions. The full schedule which was published back in Issue 13 continues to
hold up well. The main news is that transmissions at 10.00 & 11.00 UTC seem to have
ended. Those readers who have studied LP in detail will know that the 10.00 & 11.00
transmissions are sent to headers D & H, however to avoid jamming D & H do also
receive further messages included in the sliding schedule system.

Lt is possible that transmissions may be taking place outside the 12.00 to 22.00
schedule. Several years ago a set of transmissions also ran at 03.00 to 05.00. A further
report mentioned hearing LP at around 07.50! On 14487. In the evenings jamming is
also commencing at around 18.00 (previously 20.00)

On some occasions recently only two frequencies are audible; it is possible that the
third scheduled frequency may be switched to either a listed or unlisted frequency, ff
you cannot find LP on any known frequency it may be worth trying to seek it out.
One such frequency is 16314 kHz; this is used on some Tuesdays at 14.00 to substitute
11545 kHz. Please advise if you note any frequencies which are not listed below, or
when LP is noted off schedule - either frequency or time wise -from our Issue 13
efforts. Frequency list:

5422 5747 6485 6900 6959 7337 7755 8464 9251 10426 11545 12603 13375 14487
15682 16084 16314 16475. In Issue 14 we mentioned data transmissions which take
place at 48 minutes past the hour on LP transmissions. These consist of two 1 minute
bursts of FSK. We have not had any feed back on this, could readers with decoding
equipment have a listen to these and report? Thanks.

F.4 ’CHERRY RIPE’ Mode SSB

No major changes to report. Full known operating schedule is detailed below. Note
15616 dropped and replaced with new 15624 kHz.

00,00 01.00 10.00 11.00 12.00 13.00 22.00 23.00 MON to FRI only.

15624 15624 10452 9263 8230 7484 9263 17499 Thanks to Simon,

19084 19884 15624 13866 12056 11570 12056 20474 Ian & Takashi.

22108 21866 17499 14469 13866 13866 15624 23461

FAMILY XII 6647 & 11292 kHz
RQ) MAONRTIC FIF.LDS Mode AM

No reports received, may still be active on 6647 kHz on MON at either 18.00 or 19.00 -
very erratic*

VSI RASTRRN MUSIC STATION Mode A M

This station is still active on the first SAT of each month at 19.00 in Winter & 18.00
in Summer on 6645 kHz +/- 3kHz. Starting times are rather erratic and the quality of
audio and and modulation is similar. Tapes played at the wrong speed and several
false starts have become the norm with this Arabic language station (pity the agent).
The SAT March 3 transmission suffered severe interference in the UK from a strong
’R’ beacon which had taken up temporary residence on 6645 for several weeks. Can
any readers confirm if the first FRI of the month transmission is still active on 11290
kHz at either 08.20 or 09.20? On a recent SAT transmission strong broadcast audio in
Arabic (?) followed the numbers message for about 1 minute. This suggests the
transmitter is used for broadcasting purposes at other times.

STATION NEWS - OTHERS

These stations would appear to be individuals, and show no obvious sign of ’family’
relationships.

R10 PHONFTTC ALPHABET - NATO STYLE - Mode AM

Traffic levels continue to be high. The following frequencies have all been reported

active in recent months. Callsigns vary.

2270, 2626, 2743, 2943, 2953, 3090, 3150, 3270,

3417, 3640, 3840, 4165, 4270, 4360,

5820, 6270, 6370, 6378, 6498, 6658, 6745, 6575, 7322, 7445, 7540, 7605, 7918, 8465,
8642, 9130, 9402,

10352, 11565, 12747, 12950, 1270, 13533, 15980, 17410, 17966, 19715.
Message strings are still active and reports include;

VLB 5007 1 900
CIO 26B14L4416
CIO 16B53T46
CIO 24
CIO 48L15
CIO 16L12

SYN 26T15P12D38
SYN 26P15B38
MIW 24
M1W 64B4684
KPA 20L
KPA 32D21

The less active callsigns have also been active including; ROV on 4604 and the new
HNC - Hotel November Charlie on the frequency of 6575 kHz (further details about
HNC in the Simon Mason’s column in this issue). Several 160 group messages noted
recently - is this a record?

Are these stations really Mossad? The suggestion that they are has been doing the
rounds for years and like most things - once published somewhere the story sticks like
glue! Certainly some of the signals do seem to emanate from Israel but reception of
this network spans from South Africa to Japan and from Israel to the United States.
ENIGMA has recently teamed about the ultra-secret KILOWATT NETWORK, a
system not unlike that of SOUD (featured in this issue). The KW Network is made
up of E?c countries, Israel, The United Stales and South Africa. Israel is a key
player and with the other members gathers and exchanges information on countries,
organisations and individuals which are considered a threat to the alliance. Veiy little
is known about the organisation or its activities, its very existence is not public
knowledge. Is it possible that the E10 stations are in fact part of this set up. Any
information about the Kilowatt Network along with comments would be most
appreciated. (Ed note: Canada, Norway, Sweden & Switzerland are members. The
CIA & FBI are represented. Mossad & Shin Beth play a major role.

R1 5) PHONETIC ALPHABET PRE - NATO - Mode SSB

No major changes reported. Reception poor in Western Europe. Some reports
indicate different callsigns to those regularly heard, the 11.00 BEC was heard calling
RAS and the 21.00 MAS was heard calling OSS?

Active are -
11.00 BEC

18000

17.00

FYP

14000

12.00

USP

17503

17.30

MSA

5834

12.30

MSA

11170

18.00

USP

5834

13.00

BEC

11000

19.00

SAR

4130

14.00

FYP

14000

20.00

NAS

5530

16.30

MSA

6716

21.00

MSA

4130

ALL DAILY

VI 31 NEW STAR BROADCASTING - Mode A M

Very well received in Asia, signals tend to be weak in Western Europe. Noted in
Europe between 10.00 - 15.00 and also at 22.00. Frequencies in use are 8300, 8375,
9725, 11430, 13750, 15388.

transmission may start on the hour or at +30 minutes past.

VI 5) NORTH KOREAN - VIA RADIO PYONGYANG - Mode AM
The following frequencies are all reported to be carrying numbers and have been
monitored in Western Japan. 3250, 4770, 5715, 5870, 5885, 5910, 6215, 6400, 6600.
Sometimes normal Radio Pyongyang & Korean martial music can be heard on these
frequencies. Drifting on 5870, 5885 & 5910 is not unknown. Noted at 10.00, 12.00,
13.00, 14.00 & 22.00.

The main news about VI 5 concerns its use of 657 kHz MW . The station clearly has
agents equipped with domestic receivers. The transmitter normally carries the
domestic service in Korean for listeners in South Korea and Japan. The signal was
reported to be very powerful in Western Japan at 15.00.

VI 61 CHINESE - Mode AM

The reception of these stations is very hit and miss in Europe and identification is
very difficult. A possible V16 was noted on MON at 20.05 on 10125 - heard in
Australia. Other reports are all unidentified but noted on the following frequencies;
3084, 3570, 4130, 4360, 4649, 4770 (not Pyongyang), 8813.

V20) BORED MAN SPANISH - Mode AM

See feature in this issue. Operating on SUN at various times.

SUN 13.25 4106//6868 Transmissions appear 1 hour earlier in Summer
SUN 13.50 5135// ? to those noted in Winter.

SUN 14.00 6868//?

X6) THE 6 TONE REPEATING - Mode AM/ SSB The 6 Tone repeating signals are
still widely reported. Some transmissions are followed by an FSK signal which appears
between l and 2 minutes after the end of the AM 6 note signal. Some repeat in the
hour. A transmission is noted below; no schedule has ever been established. This
example shows that it is worth tuning around after hearing the 6 repeating tones.
Example

On TUE JAN 20th 19.07 6814 We received one report from Japan of a 6

19.17 -5434 tone on 13924, are these signals heard in the

19.24 5775 outside Europe generally?

19.56 5393

Do any readers have FSK readers? Sit on the frequency after the tones end -
sometimes -after about 1 minute burst of hand-keyed Morse is sent followed by a
FSK transmission. The 6 tones are, however very inconsistent in sending these
messages. Presumably uses standard Russian shift/baud rate? We have made little
progress in learning more about X6 stations. We were able to obtain a clear Morse
transmission which sent the following message: (/ represent pauses in the
transmission).

RAD/ VV UU AS AR / RAD QSY 10111 QSY 10111/UU ASA/ RAD QSY 12067
QSY 12067 SK NU - followed by FSK

RAD would seem to be the callsign (making it Russian) and the requests are to the
recipient to change to 10111 and then 12067 kHz. The ’0 ? in 10111 was sent as ’ — ’
single dash.

2 \

SIMON MASON WRITES . . .

Helio again, and welcome to another column in the ENIGMA newsletter.

♦ INTERNET First, some news for everyone who has access to the Internet. I
have collated a Web page that includes the book "Secret Signais - The Euro
Numbers Mystery" which you can read on-line for free. The publisher has said that
it is now out of print, so I thought there would be no objections to having it on the
Internet. Thanks to Gerry Dexter for his help. As well as the book, there are lots of
other items, including full schedules of Lincolnshire Poacher (E3) courtesy of
ENIGMA, a full Cherry Ripe (E4) schedule from Simon Denneen in Australia and 2
Letter (E16/G16) schedules compiled by myself. There are also some photographs,
including QSLs of OLX (S16/M6) and KKN44 (M25). In addition there is also one
from a British Forces transmission on 6840 kHz, which came with a letter that said
in part 'The transmitter that radiates this frequency is situated in Cyprus and the
transmissions are directed toward the Gulf region". Sounds familiar!

Other photographs of one time pads and a gigantic embassy log periodic antenna
are shown as are various articles and letters. The address is -
http://www.btinternet.com/ ~ simon.mason - then dick on the "Secret Signals" icon.

♦ NEW PHONETIC ALPHABET (El 01 STATION FOUND - There I was minding my
own business listening to the latest output figures of tractors, built at factory no.1
on that most interesting and unbiased of stations - Radio Pyongyang, when out of
the blue came a very familiar voice "HOTEL NOVEMBER CHARLIE -HOTEL, this
was on 6575 kHz on 29 March 1 998 at 20.25 UTC. The transmission only lasted 3
minutes. I then listened for the next few nights and was rewarded at 19.00 on 2
April 1998 with "HNC-Z", again lasting only 3 minutes. Then on 9 April 1998, there
it was again, this time for 6 minutes between 20.00 and 20.06 UTC with "HNC-A".
Monitoring is still ongoing to try and establish a pattern, but it would seem to be
one of those rare and infrequent stations like ZWL and NPD. It’s quite a good
hiding place, under the sometimes quite strong Radio Pyongyang and I wonder
what those dear listeners think of their favourite programmes being ruined by this
Lady?

Quite a few of these stations have sent rare messages during the last few months
13 January at 19.15 on 5630 kHz - SYN had a 10 group message, MIW five days
later at 19.15 UTC sent 73 - 5 Letter groups and VLB sent a to group message on
31 March 1998 at 19.45 UTC. On 2743//4880 kHz at 20.00 UTC, ULX had a very
long message, "Group 160" she said. Should be interesting I thought, there is no
way that they can send a 160 group message, repeat it and get cleared in time for
another message at 20.30 UTC. To add to the interest a sawtooth jammer
appeared on 4880 kHz at 20.03 UTC, then at 20.22 UTC "Repeat, Group 160" was
sent and the start of the message was broadcast, however, at 20.25 UTC the
station suddenly left the air. At 20.29 UTC, the carrier of the jammer reappeared
and at 20.30 UTC a very faint "ULX" could be heard with an 1 1 group message. At
21 .00 UTC a stronger ULX sent 70 - 5 Letter groups.

♦ SWEDISH RHAPSODY - (G2/M4) I have been involved with some very
interesting e-mail exchanges with numbers station enthusiasts in Austria. This ail
came about when someone asked if anyone knew of an Austrian numbers station.

I replied to the group saying that according to ’Langley Pierce’s book’ "intercepting
Number Stations", the Swedish Rhapsody (G2/M4) station was operated by
Austrian Intelligence. Several people asked for recordings of this station so they
could assess whether or not the announcer had an Austrian accent, so I sent a
sound file to them. The replies stated the announcer had no Austrian accent and
indeed was not even a native German speaker at all. This seems strange as it has
been on the air for so many years that it should have been identified by now in
much the same way that other stations have been made. Of course, several
theories have been proposed including Poland, Italy and Switzerland, but none
have really been accepted as definitive, but one of these is much more likely than
the others. Here are the comments of Jascha Ruesseler of Marburg, central
Germany. T listen to this station regularly and for me (as a German) it does not
sound like having an Austrian accent. That does not mean that it isn’t Austrian
Intelligence. What I do know is that it has been active since at least the early
1960s; its activities didn’t change after the German unification, and it is strong in
central Europe. To my knowledge DF’ing attempts have not yielded definite
results”.

♦ MARK THOMAS COMEDY PRODUCT - Number Stations get their own TV series
(kind of). In the recent comedy series shown on Channel 4 in the U.K., Mark
Thomas an anarchic prankster had as part of his stage backdrop a large poster
with a complete Lincolnshire Poacher call up and message, it also included the
words “Gong Gong" inside a circle. No mention was made all the way through the
series until, on the final programme, he said that some of his friends had asked
him what the background was for. He then explained that it was a message from a
Number Station, which were illegal and officially did not exist, although you could
be prosecuted for listening to a non-existent radio station. It was a bit of a
disappointment that he did not make more out of it; he probably only spoke about
it for a few minutes. At the end of the programme the credits were rolled over
more pictures of the backdrop and a 5 figure group repeating. I then speculated
on e-mail that Akin Fernandez was probably behind it, as the backdrop was based
on the message shown in his 4-CD Conet recordings. Akin replied that he wished
that this was the case and that in a previous unrelated comedy series he had
supplied the music from his studios. The producer of the Mark Thomas show was
the same one as for the previous series and was interested in Akin's work,
including the Conet CDs. The producer then decided that the Lincolnshire Poacher
message was perfect for the show as it fitted in with Thomas’s trade-mark of
"poking fun" at the "Establishment". Internet users can view the background for
themselves at - http//www.fnord.demon.co.uk/second.html - This also includes a
more complete version ol the tune playing along in the background.

♦ WHISKY LIMA (G161 PROPAGATION INTRIGUE - One of the German 2-Letter
stations (G16), Whisky Lima shows very unusual frequency usage. The 10.00 UTC
transmission every Sunday seems to be broadcast from the southern hemisphere.
Let’s look at the frequencies used. In November and December 1997 heading
towards mid-winter in the northern hemisphere, it’s on 20240 kHz, a very high
frequency for winter, especially at sunspot minimum. In February 1998, it dropped
to 19755 kHz. Spring arrives and it changes to 16220 for March and April. At the
height of summer in June is uses 13890 and in July 12092 kHz. This is the
complete opposite of what would be expected for a station operating in the
northern hemisphere. Also, the time slot used could be an early evening
transmission for the Far East and Australia. Contrast this with the WL broadcast on
Thursdays at 19.30 UTC. a European evening slot. In January 7404 kHz is used
compared with 13890 kHz for July’s transmission. This would mean that WL is
used for two separate locations and I intend to see if the addressee 3F identifiers
used are different for the two days, I suspect they might be. (They are Ed.)

The English language station Mike Delta (El 6) also seems to be in the southern
hemisphere. At 13.30 UTC in June it uses 12092 kHz, July 12210 kHz, August
12314 kHz, September 14622 kHz, October, November and December 16220 kHz
is used. MD has even been noted at 08.00 UTC in the middle of December on
19295 kHz, while for the same time slot in July 12210 kHz is used, in contrast,
Golf Kilo is a typical European station. From January to December at 19.30 UTC,
the following sequence is used for the Sunday broadcast: JAN 3262, FEB 4888,
MAR 5732, APR & MAY 7404. JUNE 8063, JULY 9325, AUG 7404 , SEPT 6853,
OCT 5770, NOV 4888, DEC 3228 kHz. So it would seem that perhaps there has
been a shift from Cold War days of operating in the European evenings on 3/4/5
MHz frequencies to other more remote areas.

Given that most Number Stations aim to hit their targets during the local evening in
order to protect their cover, I suppose the following target areas are not out of the
question:

WL 10.00 SUN China WL 19.30 THU Russia MD 09.00 SUN China

MD 13.30 THU Iraq GK21.30FRI Europe GK 01 .30 SAT U.S.A.

BL 08.00/20.00 Daily, possibly Europe (prior to and after office hours)

■ That’s about all for now, until next time my best wishes to everyone.

A®. . . .

LETTERS TO ENIGMA

A warm welcome to issue 15. Lots of letters to get through so straight in. First, two
letters about the newsletter itself. We are going to take the unusual step of
publishing the full text of a letter received from Harold in Southampton. We felt it
raised some important issues and answering them via the pages of ENIGMA may
be helpful to other readers.

Harold writes: 7 thought I would take this opportunity to write to you to point out
something that might have been overlooked in the Newsletter. Looking through the section
dealing with the voice stations there is mention of plenty of frequencies relevant to a
particular station even though that station may receive little attention from monitors
because of language problems.

t am not in the least against this even though if I heard V13 New Star Broadcasting it
would mean little to me unless English was being used. V2 on page 12 of issue 14
abounds with frequencies but is only of interest to those who speak Spanish. The Morse
section is quiie another matter. Mi 2 on page 18 the author says is ’ Extremely Active ' but
no mention of a frequency anywhere. The same goes for Ml 3 Ml 4/24 below : I have always
regarded the Morse section as the poor relation of the voice section and would like to
contribute logs of the Morse stations, but how can the author of this section tell us that a
particular station is extremely busy and then say nothing about the frequency.

i do realise of course that part of monitoring means that the operator must try and find
frequencies for himself having done the job in the past professionally, but if the
frequencies of M12 for example are known or even just a starting point why are they not
mentioned. I know that you would like more logs from Morse monitors, but suspect that
this is the reason that they are not forthcoming. Page 17 has a big section of MIG but
nothing about where it may be found.

New readers must be at a great disadvantage when reading the Morse section of ENIGMA
if they do not have the back numbers to refer to, so one assumes that its of little use to
them even though many may be proficient in the reading of the coda. Perhaps things will
change for the better when you alter the format in the next issue 1 '.

On a similar theme ’A’ from Oswestry Shropshire writes "Still mystified by the
numbering system, but think I saw a reference to a kind of directory in the next issue.
Hope that helps '

First of all then, let us start by saying that we do welcome constructive criticism of
the newsletter. We hope to answer your comments in the forthcoming pages and
also hopefully present some solutions. When ENIGMA was formed in 1993 it
started out Jtas five A4 photocopied pages covering voice stations. It has
progressed into a 60 page journal with the help and support of hundreds of
readers who regularly contribute logs, news, features and dippings. In 1992 little
had been published on the subject. A newsletter written by the late Havana Moon
(much of which was amateurish and unreliable by today's standard) and Simon
Mason’s ’Secret Signals’ represented about 90% of the reference material
available. In Britain, magazines gave the subject a cautionary passing mention,
partly due to the unease about the subject.

ENIGMA set out with the aim of collating the logs and schedules of stations in
order to learn more about the habits of these peculiar stations. It was dear that no
one monitor could listen to and log all the traffic, and ENIGMA provided a
reasonable solution to this problem by attempting to schedule stations (however,
this is rather more complex than we envisaged back at issue 3) At issue 3 Mike
Gauffman joined ENIGMA and introduced the subject of Morse numbers stations (a
crudal component) through a series of articles and format charts. It soon became
clear that Morse traffic needed its own section which was duly introduced in issue
6. Since this time Morse has remained a separate section in the Newsletter. It is
through this process of evolution that we have reached our present position.

Between issues 6 and 14, ENIGMA has grown from strength to strength and our
understanding of the subject has grown with it. Three key points have become
clear (details of which we hope will go a long way to answering the questions
posed in the letters above).

1 ) PRINTING SCHEDULES : Of the numerous stations operating, none are alike in
their habits, they all have their own idiosyncrasies and complexities to unravel. This
is where the challenge lies, for we must glean as much as possible with what
initially seems very little to go on. We cannot treat them as we would broadcast,
amateur or utility stations, for they are something totally alien and follow their own
rules. We must adapt our mind accordingly and create order, where a casual
monitor would only see chaos. With great patience and systematic logging we can
discover these rules, predict schedules and analyse traffic. It is from this base that
we should note that attempting to schedule some stations in the newsletter Is
relatively easy; they use fixed frequencies and day/time slots. Others, however; are
either tailored to the individual recipient or are maverick in nature with no
identifiable schedule. There is little point in attempting to publish schedules for
every station in ENIGMA, the use of frequencies can change from day to day along
with the time slots and much of the information would be useless by the time it
reached the printers. Others are better behaved but much work is often required in
tracking them down, again the best we can hope to offer is an indication of the
activity between each issue. This seems like a good point to assure readers in the
clearest possible terms that your logs are important - even though they may not be
published directly they are used to give a status level to the operation of a station
or to indicate new schedules starting or ending. Other logs fill in missing parts to
schedules or provide those welcome surprises when a maverick is re-discovered.

2) PREVIOUSLY PUBLISHED INFORMATION : Earlier we used the word ’evolution’.
It is true to say that information previously published can be difficult to find or non-
existent if you do not have the relevant issue. It is to this end that we have
prepared an ENIGMA booklet which we are sending to every reader. The booklet
will pull together the following:

a) The voice and Morse format chart with full cross references.

b) Details on the scheduling habits of each family

c) A list of ’fixed’ frequencies (where applicable).

The nett result of the booklet is to reduce repetition in ’Station News’ and provide
definitive information to assist in the identification and logging of known stations.

3) FAMILIES : The introduction of families is the next step in the ’evolution' of
ENIGMA. Previously we have iisted voice and Morse stations as separate entities.
The new family system will aliow readers to see the whole picture, by operating
agency, under one heading.

We are always open to suggestions and welcome your comments on the above
subject in future newsletters.

A request now from ’S’ in Warwick concerning a computer game. He tells us that
he was watching the popular television programme Games Master about games
you can obtain for your P.C. and saw a P.C. Programme which was about the
ENIGMA machine. It was animated and would take you through the operation of
the machine, a sort of simulator for operators, if you did something wrong while
you were using it an assistant would appear at a doorway and offer help. After
training you would be given various encrypted messages you would have to
decipher. Has anyone seen the game or similar? Is it still available? There is an
ENIGMA simulator for the Atari ST available from Goodmans PDL. But it is not a
patch on this P.C. programme. If you can help ’S’ please write via ENIGMA and we
will forward your letters.

A few quick greetings now. Hello to Enc in Vancouver, Canada. He tells us that he

is originally from Whitley Bay in Northern England and has lived in Canada for over
30 years and had an interest in radio for over 50 years. Staying in Canada, we also
welcome Daryl in Toronto who aiso recently joined ENIGMA, we iook forward to
your logs from that part of the world. Back to Britain, and David in Colchester,
Essex comments, ’It was interesting to hear Simon Mason on Radio Netherland
Media Network programme discussing Number Stations’. He also comments on
our Direction Finding activities and offers his assistance.

Staying on the DF subject, Harold writes from Giessen in Germany, “During WWII
the British Navy developed a very good space-saving HF-RDF system called "High
Frequency Direction Finder" (nick-named Huff-Duff), to be based on their ships for
tracking down German U-Boats transmitting on shortwave". Further information can
be found including drawings/plans and photographs of the Huff Duff system
(which, by the way, is not an Adcock as mentioned in other books) in Arthur O.
Bauer’s excellent new book “Funkspeilung als allierte Waffe gegen deutsche
U-Boote 1939-1945.” In the UK details on DF may be found in Redgment, P.G.:
High-Frequency Direction Finding. In: Kingsley, F.A. (ed.): The Applications of
radar and other Electronic Systems in the Royal Navy in World War II, Basingstoke
1 995. Do any readers have the exact address of the publishers of the latter?

Further DF information can also be found in ’Operation Instructions for D/F outfits
FH 4 with Switched Coils (B.R. 1442).’ Admiralty 1945. ’Journal of the Institution of

Electrical Engineering’ Part Ilia 94 1947, based on Proceedings at the Radio
Communications Convention, March/April 1947.

P.T.A. writing from Edinburgh also asks about DF information and is keen to make
a start. We are addressing this matter - thanks for your interest. He also greatly
appreciated the advanced notice about our appearance on the TV programme
"Here & Now” last year. He also asks how ’old’ logs should be before they are no
longer of interest? The answer is that we appreciate all logs between the
publication dates of each issue - however - we are also very interested in historical
information covering any period up to the present. This is vital for ongoing
research, and cannot be emphasised to strongly.

"Number Stations mentioned on RAi, the Ital ian Broadcasting Service" . Thanks to
Andrea Borgnino, an Italian DXer who began working for RAI, the subject of
numbers stations was covered on an official Italian station. Just a few minutes, with
a couple of sound bites were given over in "Golem", a morning radio programme
dealing with oddities in Television and radio programmes.

Regular contributor Paui in London wrote to thank us for our feature on Iraq’s
secret monitoring facilities ’Project 858' in the last issue. He has very kindiy sent
us a copy of one of the personalised club cards for YI2AM (the former RAF
monitoring station at Habbaniva. He also goes onto tell us about the book ’Secret
Power’ - New Zealand’s role in the international Spy Network by Nicky Hager and
published by Craig Potton Publishing. “My wife purchased my copy for Christmas,
unfortunately I left my copy on the train; luckily this was the third time of reading.
In keeping with modern practice it has not been handed in.”

The book covers not oniy the input by NZ but feasibly the manner in which our
own GCHQ operates. There are fourteen chapters, and five appendices, 299 pages
in all.

Chapter 2 outlines the spy network, and in particular, UKUSA. Chapter 3 reveals
the way in which ECHELON functions and Chapter 4 explains the role of the
UKUSA in the Cold War.

in the remaining chapters the author looks at the secrecy rationale, the ’Lords and
Masters’ who control the facilities, how the various styles of eavesdropping are
carried out and exactly what the secrets are. (The information available in this book
is a must for any person with an interest in the covered subject, you do not need a
degree to surmise that one station’s function must be the same as another
station’s within the alliance). Photographs and illustrations compliment the text.
Acknowledgements are given to Duncan Campbell and Jeff Richeison and one
forward is given by David Lange, Prime Minister of NZ 1984 to 1989.

The book published in 1996 and now reprinted is available at a cost of NZ$ 26.50
plus NZ$22 airmail or NZ$15 economy post. Craig Potton prefer payment by Visa
or Mastercard, but will accept Postal Orders.

Craig Potton Publishing Phone: 64-3-548-9002

PO Box 555 Facsimile: 64-3-546-9192

Nelson email: info@cpp.nz

New Zealand More info: http://www.fas.org/irp/eprirrt/sp/index.htmi

Paul concludes. 'This is the best ever in factual writing on intelligence matters, that
can be purchased. It is well worth the money and makes others look like poorly
written novelettes".

Greetings now to Lars (Germany). Thank you for your logs and letter. He tell us
that he found the following in an old radio publication which mentioned
transmissions by Interpol, which translated as follows: 'To keep clear an existing
channel from other stations the central broadcaster transmits at short intervals their
call sign in CW" - This is almost certainly HEP, but why from Switzerland when
Interpol HQ is at Lyons - complete with 4 HF log-periodics?

Quick hellos now to regular contributor Vassily (Moscow) and to Hans (Trier,
Germany), thanks for all the logs which are most appreciated. Greetings to Gert in
Holland and congratulations on your recent wedding.

Staying in Germany, Kai sends us some interesting information about the
espionage radio transmissions of the former DDR. The recently published book
"100 Jahre Funktechnik in Deutschland - Funksendestellen rund um Berlin"
describes in detail the SW facilities of the Ministerium fur Staatssicherheit (MfS at
Zeesen.

Zeesen is situated just a few kilometres south of Konigs Wusterhausen. in 1S36 a
large SVV broadcasting facility was built (the same year as the Olympic Games in
Berlin). In 1945, the whole equipment was confiscated and transferred to the
USSR, the buildings and antennas were destroyed.

In 1958, the DDR - PTT decided to re-establish a SW broadcasting facility at
Zeesen. At an advanced stage the MfS stepped in and in 1960 opened its SW
transmitting station. The station consisted of a transmitter building, a house for the
emergency generators (6 turbo charged diesel units with a capacity of 960 kVA)
and antennas.

Until 1990, a total of 32 SW transmitters were in operation in all the usual modes. 4
water-cooled transmitters from the USSR had a power of 25 kW, the remaining
transmitters were air-cooled models, built in the USSR & DDR, with powers ranging
from 1 to 20 kW. The transmitter hall was 50 x 14.5 metres and had a control
cubicle in its centre.

The antennas were installed on 62 masts of 30 metre height and three towers of
45 metres height. In addition the station had a tower 59 metres in height for
microwave links. The SW antenna array included 9 horizontal broad-band dipoles,
8 verticals, 4 log-periodics and 9 rhombics and matrix switching facilities.

ENIGMA readers will not be surprised to learn that the site was double fenced with
floodlights. The transmitter house had a further tall high-voltage electric fence
around it; in addition the site was patrolled and guarded by heavily armed guards.

In 1 990 the PTT took over the grounds again. The equipment was dismantled and
part of the building is now used by the Deutsche Telekom telephone service.

From Germany to Japan, and hello to Takashi in Nagasaki. A fine selection of logs
and some interesting observations. Cherry Ripe (E4) is reported with powerful
signals. Also reported coming in well are Counting Stations (E5). He asks for a full
schedule! Sorry but this is not a station which remains constant enough. Please
See earlier comments in response to letter from Harold. Lots of Phonetic Alphabet
stations (El 0) confirming its worldwide coverage.

Several stations which are based in Asia are also very busy. New Star Radio (V 13)
is reported to be very powerful in the daytime. North Korean (VI 5) is still very
active and is sending number transmissions on SW and on 657 kHz MW which are
giving excellent reception in Western Japan. Cluster Beacons (MX) are giving
interesting results with many beacons in the clusters which cannot be heard in
Europe. The reception in Japan is as follows: (Those underlined not heard in
Europe)

5154 (E. F. K, V) . 7039 (C, F. K. M. P, S), 8039 (C, FJ<, P, S),

10872 (C, F, P, S), 13528 (C, FJ<, P, S). 16332 (C, F, P, S),

20048 (C, F, P, S). (Others heard in Europe not listed here).

Back from the Far East now to the East of England and Peter (Saffron Walden)
(Essex). A fine collection of logs and observations. Starting on Christmas Day
when he remarks - " I made a point of listening on the evening of Christmas Day
and it was obvious that the spy business doesn’t take a day off; I heard Counting
Stations (E5), Russian Man (S7), German Lady (G7), two separate English Men
(E6), Lincolnshire Poacher (E3) and jammer, M12 & even a German 2 Letter station
G16). He goes on to comment on activity, Counting Stations (E5) in the shape of
Cynthia continues her career; activity is down from the all time highs of the autumn
of 1997. There have been many changes to the operating schedule with each
passing month with some long-standing frequencies discontinued. Rather like
some other stations, Cynthia likes to return to her old frequencies over time.
Staying on E5 for a moment the call ’383' has been heard sending a message.
’383’ in English and ’545’ in Spanish (V5) have the curious distinction of sending
the familiar call up for 10 minutes but at the sound of the tenth ’tone’ abruptly
going off air and never sending a single message. ’ 21 .00 UTC on 9090 kHz on
SUN 5th April - ’383’. On previous occasions, when 383 was the "Call”, such as in
FEB and MARCH 1993 - and earlier, as mentioned by Simon Mason in his "Secret
Signals" book, the transmission terminated without a "Count 1 or a 3/2f message
after the 10-minute "383” warm-up and went off. However, this was not the case
this time, "383" being followed by “Count 175” and the usual 3/2f format’.

He also comments on the major changes which have taken place by Swedish
Rhapsody (G2/M4) - see station news . Following our feature on E5 over issues 13
& 14 Peter has kindly agreed to put German Lady (G7) under the spotlight and we

will be carry this in issue 16.

Greetings now to Andreas (Lands berg, Germany). He sent us a detailed letter and
comments on the last issue. First off, the subject of whether listening to Number
Stations is legal, a point raised by Peter in in issue 14. A recent court case in
Germany raises some interesting points. The radio journalist Nils Schiffhauer won
a trial against the authorities who wanted to procecute him for listening to Police
frequencies. He also published frequencies and gave details of what could be
heard in German radio magazine. The trial was, howeve.r a success for Nils. The
judge ruled that "it is forbidden to listen to broadcasts not intended for the public,
but how will the public know what is and is not intended for them?" The judge said
"everything in clear speech seems to be intended for the public, and encryption
systems should be used for all other transmissions - breaking these would be
illegal." The judge recommended that ail systems in clear speech broadcast a
message 'This broadcast is not intended for the general public" twice each
minute". The same would apply to Morse stations, too (Ed.) Just imagine the
incoven ience this would pose for agents taking down messages! So Germany is
looking for a secure police communications system. Andreas suggests that
Number Station operators broadcast such a message, otherwise it is legal to listen
to them in Germany. He also comments on our new News Round-Up feature and
hopes ft will become a regular slot. We have had a good response to this, please
keep contributions coming in.

On the subject of HF sites, he tells us that he recently came across a report that
might help us to locate transmitting stations. It appeared in a air/spaceflight
journal, “Flieger Revue", edition 5/1998. A report about transmitting stations
concerned an accident in October 1997 when an hydrogen balloon crashed close
to the transmitting station at Nauen. The reason was that current was induced in a
metal ring holding the balloon - the ring became hot, the cover “melted" away,
hydrogen escaped and the balloon exploded. The report dealt with the problem of
pilots receiving information about dangerous transmitting stations, that couid cause
engine malfunctions. The maps of the ICAO don’t list these transmitters in detail.
But the Air Force does. So one suggestion is to look into the "Militarisches
Luftfahrt Handbuch" (Military Aviation Handbook) for "High Intensity Radio
Transmission Area" (HIRTA). As this literature is NATO standardised, it could
provide us with some useful information about HF sites, and after sifting out known
locations, more secret sites may remain. (Used this method long ago with success
but only in U.K. - Ed.) Hobby pilots are advised to ask local aero clubs or the
Federal Aviation Bureau (Luftfahrtbundesamt) . The book also contains other
information about areas of high risk, such as over nuclear reactors, military air
zones. Do other ENIGMA members have access to this kind of information?

From Germany back to Britain and Dominic (Cheltenham). He recently joined
ENIGMA after reading about us in Shortwave Magazine. He recounts an interesting
story: "About 7 or 8 years ago while searching the 4 & 5MHz region I received a
female voice reading out a list of numbers in a foreign language. I though it might
be German, so I taped about 5 minutes of it and let my scout leader, (a GCHQ
employee) who spoke the language fluently, have a listen. What he said was a bit
of a surprise to me, "It’s nothing much, just a message for some kind of secret

agent working for Germany". He translated the tape and from what I remember it
contained strings of 5 numbers, these were proceeded by two electronic tones. I
soon forgot all about it until March 1997.

! was in Lowe electronics in Bristol buying a new receiver when ! saw a back copy
of SWM containing a feature on numbers stations. When I looked at the list there
was one which stood out, The Two Letter Stations (G16,E16). This was the strange
voice I had heard years ago, and looking at the characteristics they were all the
same. Lowe kindly photocopied the feature I rushed home to see if I could pick up
more stations - and I haven’t iooked back since”. (Ed note: Who says GCHQ are
not helpful!)

Staying in the Cheltenham area we greet Dave (Shropshire). He congratulates us
on the details about Merlin communications -1 00% correct, (Lincolnshire Poacher
article - last issue) however, we did make a mistake with BEMRS. This should be
British East Mediteranean Reiay Station and not BBC-EMRS. He tell us that the
authorities on the Island do not like the incorrect version on envelopes - the same
is true (not mentioned in ENIGMA) of the BBC Eastern relay at Masirah in Oman.

He also asks what happened to the "U" single letter transmission which operated

on 6243 kHz during the 1970s and 1980‘s and what became of

Schulungssender des Qsterreichischen Bundesheeres the Austrian Army Training
Transmitter which operated on 6221 kHz or 6250 kHz in the 1370s. ...or Turkish
Police Radio on 6400 kHz?

He also mentions the use of 6840 kHz (Simon Mason’s column page 39 last
issue). "November 1980 - are you sure this was a BBC WS Feeder frequency at
that time? I thought ail the sideband transmitters (1 at Rampisham and 2 at
Daverrtry) had closed by then. Perhaps others such as British Telecom at Rugby
etc. or SSVC (Services Sound & Video Corp.) at Chalfont were putting out SSB
feeders at that time?” (Ed note: Chalfont has no HF, but may have used HF
transmitters at a BT site).

Greetings to Michiel who sends us an email from Doom in The Netherlands.
Regarding part two of the Lincolnshire Poacher article, I would like to add one
observation to the Mistakes paragraph. Here’s my logbook entry from 20 July
1994 at 13.17 UTC on 14487. Details: Female speaker with 5-figure groups.
According to ’Langley Pierce’s book, this is MI6 perhaps via the RAF site at Akrotiri
(Cyprus). Seems a good assumption: the familiar audio of RAF’s VFT aggregate
was heard for a while on the background!

Regarding the REM4 - station, there was a detailed article about it in a voluminous
utility guide from an Austrian DX organisation, published in the late 1970s or early
1980s. Unfortunately, this guide did not survive my most recent archive clear-up.
Anyway, the organisation behind REM4 is called Institute of Applied geophysics
(IAG) Moscow. I am not aware that the IAG has ever been seen as a covert
operation of any kind.

Almost finally, thanks go to Guy (Portsmouth) Rob (Essex) and Andy (Merseyside)
who each send regular logs and observations. Thank you.

May we take this opportunity to say thanks to everyone who writes sends
facsimiles or emails - even postcards! Your contributions are very much
appreciated. We look forward to hearing from YOU .

THI NGS THAT GO BUZZ IN THE NIGHT!

Welcome to another Buzz section. Before we go into a few regulars a couple of
questions from readers. First, Paul irt Hertfordshire who asks about a signal noted
across the range between 9920 and 10060 kHz. He describes the signal as an
'Oriental ' flute playing a tuneless series of three or four notes starting with a longer
higher one and then playing the three or four note sequence down a scale
decreasing in pitch. The whole thing then starts again and this apparently continues
ad infinitum. The signal was noted at 10.10 UTC and was still going at 17.35UTC. At
first he thought the wide-band effect was down to his receiver and tried a different
one but still heard the station. The signal is very weak. Has anyone else come across
'The Continuous Flute" ?

Our second question is a little easier to answer. Simon in Shropshire asks, what is the
2 tone bleep on 4420 kHz, a soil of "Doorbell" type of sound? This is Royal
Navy/Coastal Control Channel D. The transmitters atSt.Eval, also possibly Crimond
and Inskip etc.

John asks what the bubbling fizzing sound he hears across SW even/ 16kHz or so?
This is television line timebase interference which is generated by a nearby television
receiver and appears every 1 5625 kHz.

Now some quick mentions to some of the regulars who are still around.

XC - Crackle From early June noted on new frequency 4426 kHz. Previously resident
on usual 5500/5505 kHz for a number of years causing interference to Shannon Air
Radio on 5505 kHz. Try evening time in Europe.

XM - Backward Music Stati on After commenting on a lack of activity last issue the
signal seems to have come back to life. Heard in Europe and Australia this signal
must have wide coverage. Noted at various times between 05.00 & 21.00 UTC - it
could turn up any time. Frequencies reported: 4376 4410 4420 4740 5! 78 6755
8123 9035 kHz. Simon in Australia comments "BMS seems to be associated with
Naval or Marine frequencies". Comments welcome.

XX - The Pip Alive and well. 05.30 to 14.00 on 5450 and 14.00 to 05.30 on 3757
kHz. The latter frequency is in a band shared by Amateurs and we have noted
comments being passed about interference from 'that piping' thing. Would anyone at
'Intruder Watch' like to comment? The big news on The Pip" comes to us from John
in Derby. “On April 24th at 22.30 UTC, I tuned into XX The Pip" on 3757 kHz. At
22.41 UTC the pipping stopped and a male voice made an announcement in what I
think was a Slavic language, a number of phrases were given with short pauses in
between. This only lasted two minutes at the most and the piping came back on". This
sounds very similar to the Buzzer (S28/XB) noted on DEC 24th 1997. Thanks, John
for that. Readers please keep an ear on this one!

The Blank Carrier Mentioned last time around, this signal appears on 5305 kHz on
the hour for exactly 20 minutes. The process repeats each hour. We mentioned that
it can be heard between 09.00 and 22.00, but recent monitoring at 00.00 UTC
revealed the signal to be present. Feedback from Mike in Kent who kindly sent the

e V

0 ^°5

following observations: " 1 tuned in early for a further listen to 5305 as the channel
was reasonably quiet. There is a "signal" there. The unmodulated carrier came up
about 500msec before the "hum" started and I had a good recording for a few
minutes before some flutter set in. More information on this signal is required.

Another ENIGMA exclusive.

XF - Faders Chris's favourite hobby horse. A letter from Richard gives us a exclusive
breakthrough on these signals. He writes. Tve monitored the "Faders" quite a few
times and have noticed a remarkable resemblance to frequencies that the USAF/US
Army used in Europe about 5 or 6 years ago for their voice nets "INFORM" & "GANG
BUSTER". These nets were used to pass EAMs (Emergency Action Messages) to US Air
Force and Army bases. It used to be extremely active but following the US military
withdrawals from Europe and consequent base closures the Net went off the air."

See 'Frequency Match Lisf with this article and let us have your comments.

Richard writes; "Resulting from my suspicions I decided to investigate further. I packed
my radio and went along to "RAF" Miidenhail, Suffolk and sat opposite the USAF HF
transmitters (a small compound) and Faders were transmitting on 9125 and 6875
kHz, sometimes in parallel and at other times they operated independently. They were
very busy. When I connected an aerial to my receiver I could hear replies from other
Faders in the net. Later in the afternoon 6875 was dropped and 5327 kHz came into
use. Then early evening 5327 dropped, 6875 came back and 9125 went up to 9126
kHz. Another possible location in the UK would be "RAF" Barford St John."

'Faders' may be part of the virtually unknown LOCE network, NATO's only secure
data transmission system. LOCE ~ Linked Operational - Intelligence Centers -
Europe. The analysis centra is located on a military base at Moles worth. It collates
and interprets “intelligence from satellites, piloted and pilotless spy planes, electronic
surveillance and human agents". Comments welcome.

We gave Faders a mention in the ENIGMA column of the May issue of Shortwave
Magazine and hope for some further feedback. For all the wonders of modern
science these unusual signals seem to have evaded the clutches of demodulation! We
cannot emphasise too much how busy they are. If you have never tried to find them
then tune in soon!

This particular mode (see previous issues for description/habits) shows little respect for
other users and operates across the Fixed Services, Amateur, Aeronautical and
Shipping bands. We have heard it transmitting on top of a Coastal Station which was
sending out a warning of floating debris. Recently a Fader was noted blocking out a
station on 10480 which was sending a radio check under the callsign I4CF.

$28 (formally XB) - Buzzer 4625 kHz. Our "World Exclusive" Buzzer sends a message
created a mixed response! Mike in Reading wrote: Re: "Buzzer 4625 kHz This was a
hoax message you referred to I assume". He adds that the Buzzer does vary its
transmission. Note that the two-tone buzz which normally appears at 1 minute to the
hour has been known to appear at other times, and miss the h + 59 'slot'.

Kai writing from Germany joins in the debate. "In my opinion the destination of this
frequency cannot be Vienna, as it is simply too low for daytime reception there.
Already here in Eastern Germany The Buzzer fades in just before sunset. If this is a
feed to Vienna, they would use a much higher daytime frequency. The selection of the

60 metre band 24 hours per day leads me to assume that the intended audience is
somewhere in the CIS itself: During daylight the range is not much more than about
1000 km, at night the transmitter suffers no dead zone. With reference to the
message of Christmas Eve the relationship between St 3/14 and S28 (Buzzer) leads
me to conclude that this is an alarm transmitter for the Russian Army and that the
message sent was a test transmission".

At ENIGMA we have continued to make our own investigations. Despite three letters
each to the State Frequency Committee and the Radio Communications Authority,
(both in Moscow) neither agency has had the courtesy to reply. This suggests that the
official line is to say nothing and hope we will go away!

Mew information. For reasons of confidentiality several words are removed from the
following statement 'Thank you very much for your letter of **** . I would like to
inform you that at our request ******** specialists ran a triangulation on the "Buzzer"
radio station. I quote from their report: "We have carried out a search/measurement
together with partners in Germany and Sweden. It seems that the station is sending
from Russia, in the Moscow region.

Earlier we asked the Polish communications administration about the 4625.0 kHz
frequency and never received a reply. I think that the professional HF triangulation
from ******* r Sweden and Germany are more accurate than the earlier 'Thompson"
narrow base triangulation made from France. Please allow me to draw your attention
to the fact that at the end of every hour the "Buzzer" changes its signal and gives a
steady variable signal tone (most frequently on the 59:00 to 60:00th minute). At this
time we are preparing to ask the Russian Communications and information
Committee. When I get more information I will let you know. The available data still
does not confirm anything completely but I suspect that the "Buzzer" originates from
the Moscow region and has some military purpose. The next stage of the research
would require an expedition to the Target Area.' (Thanks to 'A' for this information).
Our thanks to David (Wales) for the original recording and Vassily (Moscow) for his
assistance.

Frequency 4625 kHz - December 25th 1997 - 21 ,58 UTC .

We can confirm the “Buzzer" does in fact have a callsign. This is UZB-76, this is
UZ8-76'. The "message" was constructed of numbers and selected words from the
Russian phonetic alphabet which included; Boris, Roman, Olga, Mikail, Anna, Leonid,
The initial letter of each word spells "BROMAL". This word does not exist in the
Russian language. The word BROMAL was spoken and then given phonetically.

English translation of words spoken are underlined .

This is UZB-76. This is UZB-76 ". (2 words? Unintelligible - fading). Nul Vosjim (08)
BROMAL (Spoken as one word). (Unintelligible few words - include figures) "Dvatsat
-Shest" (26) "Jedinitsa chetjorka nul nul petjorka" ( 14005 ) " Boris Roman Olga Mikail
Anna Leonid " (spoken as individual words). (Figures!) "Simjorka (?) chetjorka dvoika
njorka (?) njorka (?) njorka (?) jedinitsa chetjorka (? 42???14) (8 figures) (All repeated
once).

Numbers used: jedinitsa (1), dvoika (2), ? (3), chetjorka (4), petjorka (5), ? (6),
? simjorka (7), vosjim (8), ? (9), nu! (0). Comments welcome.

FADERS - FREQUENCY MATCH LIST

Acknowledgements to Richard.

2403 A1

7305 A14

(F) 13431302

2452 A2

7368 ???

13479A23

(F)

2470

7384 A15

13545A24

3060 R13

7424 A16

14374A25

(F)

3188

(F)

7500

14423A26

3215 A3

(F)

7658

14505 A27

(F)

3382

(F)

7665

14682 A28

3688 T01

7740 A17

14705L01

3760 J13

(F)

7813

15476 A29

3931 BOS

7919 A18

1 5560 A30

3946 A6

(F)

7997

18179A31

3958 A 7

8118 T09

18744 A32

3973 U06

(F)

8185

20539 A33

3996 ???

91 26 ???

20604 A34

4020 772

(F)

9138

20609 A35

4035 V07

9244 BOS

20349 A36

(F)

4062

9477 A1S

2031 1 A38

4458 F10

10139 A20

4477 A8

10478 Til

4480 P07

11100 A21

4496 ???

11515 ???

4545 S06

11641 A22

4560 L02

4612 A9

4821 EOS

4843

4933 M04

"INFORM NET'

prefixed A01 to A38

4980 ???

"GANGBUSTER NET'

prefixed BOS to V07

4987 T06

"UNKNOWN DESIG."

prefixed ???

5092 A10

FADERS

(F)

5105 All

FADERS UNDERLINED

(F) Match with

5146 A12

frequency used by the above networks.

(F)

5195

5311 A13

From a total of 38 known Fader frequencies 1 3

(F)

5328

match with the networks detailed above.

<F)

5398

Coincidence? Definitely not!

(F)

5468

(F)

5787

Comments welcome.

6505 J10

6796 C03

6819 A13

(F)

6824

(F)

6848

(F)

6875

3 G

About this feature. In this and forthcoming issues we will be examining the story of
SOUD. In part one we will be looking at the background from conception to the
early 1990s. This will provide the platform to examine SOUD’s radio
communications in greater detail. In part two we will be concentrating on the
technical side of operations and detailing SOUD’s activities on Shortwave, its links
with number stations and its format, traffic, modes and mistakes. In addition we
hope to bring you up to date on SOUD between the early 1990s and the present
day. Information has been drawn from a number of sources including translations
from Stasi files made by Bodo Wegmann & Monika Tantzscher, seized after the
collapse of the Berlin Wall, and from research conducted by dedicated members
of Worldwide Utility News and gathered painstakingly over a considerable period
of time. We are grateful to everyone who provided us with information for this
feature, particularly Ary in The Netherlands & Andreas in Germany.

PART ONE

S.Q.U.D.

"Sisteme Obyedinenovo Utschotya Danich o protivnike"

"System for the Unified Registration of Information Concerning the Enemy"

'The re is no other example of such widespread cooperation between services"

► INTRODUCTION - "SOUD gathering information about all possible ’enemies’ of
the alliance" - SOUD is the fascinating story of a secret organisation which was
born in the very depths of the ’Cold War*. With H.F. links from its headquarters in
Moscow SOUD built up a database the likes of which had never been assembled
before. In our feature we will be looking at SOUD from its conception right up to
the present day, detailing the communications and intelligence gathering efforts of
a vast organisation. A unique look behind the curtain!

The early 1970s. The intelligence Services of the Warsaw Treaty Organisation
(WTO) ■< began bilateral cooperation on the basis of new treaties. With new political
moves towards the West, the socialist countries became more open towards their
citizens and there was closer integration between the socialist countries
themselves. It now became possible to travel from the GDR to Poland or
Czechoslovakia without a Visa. In addition, there was greater contact and freedom
between the GDR and the FRG and travel between West Berlin and the FRG and
vice-versa became easier. Of course, it was not long before the Western
intelligence services began to take advantage of these new opportunities. Other
problems began to come to the fore with international terrorism rising, and
organisations keen to smuggle people from the GDR to the West.

In 1972 the Olympic games in Munich had seen an attack on the Israeli team by
Palestinian terrorists. The 1973 Youth World Games were scheduled to take place
in Berlin and in 1980 the Olympic games were to be held in Moscow. The East
was keen to avoid any such incidents with the eyes of the whole world watching
on.

Cooperation already existed between the KGB and the MfS and agreement had

been reached in 1973 on a joint plan to pool information within the socialist
countries. In 1974 the MfS signed an agreement to cooperate with the Bulgarian
and Polish services, and in 1977 with the Czechoslovakian StB. Cooperation also
existed between the MfS and the Hungarian AVH but to a lesser degree. Romania
was not integrated into the networks of the Eastern intelligence services.

Ail this was not only intended to cooperate against the Western intelligence
services, but also to gain a better handle on the activities of opposition movements
inside the socialist countries who were controlled from Moscow.

SOUD is born. In the early 1970s what had started has bilateral cooperation had
moved to the multilateral level. Cuba was to play host to a meeting held in 1 974.
Havana was to be the birth place of an idea which was to become SOUD. Those
who attended were later to ’sign- up’ to an organisation which was to fight against
"ideological diversion". It was not until 1976 that a meeting held in Berlin would set
out the blueprint. The KGB made a general proposal, which the MfS followed. Only
the Polish delegation had other ideas - but would sign up regardless.

"Valeri Kryuchkov from the Soviet delegation said the project should have started
earlier - and further delay would cause damage to the partners".

At the meeting held in Berlin it was agreed on the technical terms of reference.
Agreement was reached between the respective countries and the head of the
Directorate of Governmental Teleprinter Messages of the KGB. A proposal was
made from the MfS who requested a direct teleprinter link with HQ in Moscow, and
an H.F. link for more urgent questions.

► THE PLAYERS - The seeds had been planted. November 1977 and SOUD
became a reality - the member states signed the SOUD Treaty. The members of
SOUD were each allocated a code number when sending or receiving information:
1 - Czechoslovakia, 2 - GDR, 3 - Poland, 4 - Hungary, 5 - Bulgaria, 6 - Cuba, 7 -
Mongolia, 8 - USSR, 9 - Vietnam.

► DEVELOPMENTS - The next step was to begin the process of registration. It
was planned not only to register persons, but also several other centra! registration
systems were to be established, including one for the registration of foreigners and
another about the "objects of operational interest", registration and the delivery of
espionage tasks and the recording of official political and scientific information was
also to be included. The development of the database commenced in 1976 at the
computer centre of the counter intelligence department of the 2nd directorate of
the KGB. In the mid - 1970s they already had five central (electronic) recording
systems and it was planned to have one central system with different sub-sytems.

SOUD was part of the 1st directorate of the KGB, the foreign intelligence service
known as PGU. The HQ operated their central memory store and was responsible
for building - up the system, running it, coordination and the registration of the
inquiries. It was a stand alone department within the 1 st directorate.

3 &

in 1979, they had 80 employees, 30 of them in software development. The HQ of
SOUD had three sub-departments:

1) Management of the system/coordination with other members to further develop
the system.

2) Analysing the incoming information/preparation for recording/data entry/
answering queries.

3) Registration of incoming SOUD forms/maintaining archives/micro-filming the
documents.

At the outset all employees came from the KGB, it was intended to also employ
members from other partners. The flow of information from the local service to HQ
was initially only via the local KGB residence. Later coded teletype lines were
introduced from the partners to the HQ.

The development of SOUD moved along in stages. First they buiit up the computer
system, then the registration of persons. Later they went onto record the
organisations and institutions of the enemy. The computer system was prepared
during 1978. From January 1979 until December 1980 the incoming record forms
from the member services were analysed and prepared for registration. Between
January 1979 and May 1980 the detailed programming of the computer was
carried out. From May to September 1980 SOUD tested (during the Moscow -
Olympics). From September to December 1980 the results of these tests were
analysed and corrections made. December 1980 and the ’live’ SOUD system was
up and running.

The different branches of the intelligence services had to collect the information on
special forms. These were then passed to a ’bridging section’ who would translate
the information into Russian, the working language of SOUD. These were then
sent to the relevant department of SOUD in Moscow and once processed would
receive a response If Information/answers were subsequently available.

► WHO WAS THE ENEMY? - This is a most ’enlightening’ look at how the East
viewed the West particularly during the Cold War years. SOUD issued guidelines
on its information gathering requirements. Each was allocated a prefix of PK.

PK - The abbreviation PK is taken from the original Russian text translation
Personnel Category ( Personkategorie in German).

PK 1 - Collaborators and agents of enemy intelligence services and persons who
are suspected to belong to or to have connections with an enemy intelligence
service. Note: In 1988 Monitors and Inspectors of military activities working on the
basis of international treaties was also added into PK 1 .

PK 2 - Leading Collaborators of centres of "political ideological diversion" and

collaborators of such centres who directly work against the states of the socialist
community.

3 °)

PK 3 - Members of terrorist organisations, individual terrorist, hostage takers,
aircraft and ship hijackers, "diversant" and persons suspected to be in contact with
a terrorist organisation or support one.

PK 4 - Members of Zionist, enemy emigrant - clerical and other organisations. This
category also includes organisations helping citizens of the socialist countries to
escape, known as "criminal man-traders"

PK5 - Persons taking orders from enemy intelligence services, centres of political -
ideological diversion, Zionist, enemy emigrant - clerical and other organisations
who were carrying out subversive acts against the socialist countries.

PK6 - Known provocative agents from the enemy, others suspected to be sent by
enemy services, foreigners and persons without citizenship with whom in the
process of cooperation there was no success for an unknown reason.

PK 7 - Persons offering dis-information on or selling the same material and

technical models to different states of the socialist community for materia! reasons.

PK 8 - Persons who carry out provocative actions on the territory of socialist states
or against their embassy or their citizens in foreign countries.

PK 9 - Persons who are expelled from socialist countries, or who were not allowed
to enter one country of the socialist community.

PK 10 - Persons who committed very dangerous crimes against a state, hide in
foreign countries and for whom the authorities of SOUD members search. These
include crimes of high treason, acts of terror and sabotage, endangering of
international relations and hateful agitation against the state.

PK 11 - Diplomats and collaborators of embassies and consulates of NATO
member countries and of Japan, The Peoples’ Republic of China and Thailand who
are in the countries of the socialist community.

PK 12 - Correspondents from NATO member countries, Japan, The Peoples’
Republic of China and Thailand who are temporarily or permanently resident in the
socialist countries.

PK 13 - Collaborators of trade and economic agencies as well as cultural centres
of NATO members countries, Japan, The Peoples Republic of China and Thailand
who are officially registered in the countries of the socialist community.

PK 14 - Members of organisations involved in international smuggling and who
work against the socialist countries.

PK 15 - Persons who work to impair the economy of the socialist countries, this
includes those searching for economic information, those seeking to recruit
specialists and encouraging them to emigrate and those seeking to lever socialist

** companies out of work been undertaken in non-socialist countries.

Note: PK 1 to 10 inclusive were part of the SOUD treaty of 1 977.

PK 1 1 to 15 were added in October 1985.

Diplomats and Correspondents from Thailand were registered from 1988 onward
after a special appeal from Vietnam.

& SOUD EXPANDS FURTHER - Success was indeed the name of the game and in
1986 SOUD expanded its vast database to gather information on organisations and
institutions of interest to the member countries. This was in addition to the work
already well under way on individuals.

No country in the Eastern Bloc was better placed (or perhaps quite so
enthusiastic) than East Germany to gather information. The whole structure of
control was based on the very ideal of monitoring everything and everyone. The
MfS had already built up an internal database using its own "connection
department" which was part of the aptly titled "Central Analysis and Information
Group" (ZAiG). Officially referred to as ZAIG 4/4 it was not part of the KGB but a
division of the MfS. ZAIG worked closely with Moscow and members of SOUD,

The way in which members cooperated with SOUD is revealed in detail in a
document from 1989 which explains the structure of the MfS - Moscow link.

Branch 1 (5 employees): decoding and translating answers from Moscow, making
the process as effective as possible, suggesting improvements and developments.

Branch 2 (4 employees): giving out answers to questions received from Moscow
HQ, cross checking data between different users.

Branch 3 (11, later 13 employees): teletype-connection to the HQ, translation of
inquiries and other documents into Russian.

By this point you may be waiting to hear how well the system was working. SOUD
was capable of recording 300,000 people with an average 1000 bytes of
information per person

The number of people registered by SOUD up to the end of 1987 was as follows:

102,223

12,332

13,140

9,337

6,941

2,082

134

803

31,528

1,093

5,576

2,471

153

334

196

From 1979 to the end of November 1989 the MfS had supplied the details of

74,884 people to be registered in the SOLID system. Under PK 1 (of most interest
to ENIGMA readers) 4,441 suspected members of the FRG-secret service (2,213 of
the BND, 1,507 Verfassungsschutz, 721 MAD) had made it to the database. A
further 4,424 American services, 737 of British, 537 of French, 286 of Dutch, 24 of
Italian, 28 of Finnish, 20 of Iranian, 45 of Iraqi services - and more than 7,000
where no particular state or service could be confirmed were also included.

The information in SOUD could be updated and entries could also be deleted. This
was carried out when men reached the age of 80 and women 75, or when they
were no longer considered suspicious or had died. The MfS carried out
widespread checks. If a person was considered suitable for cooperation or was
perhaps to be used as a messenger he/she was checked through SOUD. The
same applied for anyone who was from the west who wanted to live in the GDR.
Inquiries using the database were also carried out on groups of people,
information on particular topics, the year of birth, place of birth etc. and
"continuous checks" could also be made on individuals.

Inquiries could be given various levels of priority. A low priority inquiry would take
between 5 and 14 days. Urgent inquiries were answered in 24 hours and "flash"
inquiries 8 hours. There were five modes when answering an enquiry, it was
possible that the agency that registered the person was informed if another
agency was later to request it from SOUD. It was also possible that the inquirer
would not be given the information only the agency who registered it or vice-versa.
The original provider may have been informed if another service sent new
information about a person they had originally registered. This was a complex
system!

The flow of information was to take place via the post and teletype links of the
local KGB-affiliate. In the summer of 1983 the ZAiG 4/4 installed a “direct Duplex
connection" to the HQ in Moscow. Via this line, only "urgent” or "flash" messages
were sent/answered to/from Moscow.

Earlier, we mentioned that organisations in addition to individuals were also
registered in SOUD. The theme of using the PK prefix continued and ran along
with the existing system.

PK 1 now included: Enemy Intelligence organisations
PK 2 now included: Centres of political-ideological diversion
PK 3 now included: Terrorist organisations
PK 4 now included: Enemy emigrant organisations

► MEETING OF THE MINDS - Between March 18th and 20th 1986, SOUD
members held the first multilateral conference in Moscow. In the MfS archives, only
the speech of the leader of the MfS-delegation was discovered. In general he
mentioned examples of how SOUD had helped in the work of the MfS. In general it
was discussed that the percentage of positive answers from SOUD were low and
not all the answers of great use. It was also decided that conferences should be
held every two years, however there were only ever two meetings - events in the

USSR would later dictate the agenda.

More information is available about the second meeting. Delegates bordered their
Tupelovs and headed for Sofia in Bulgaria. The conference was held between May
16th and 20th 1988. Figures concerning the registration of individuals made over
previous years was disclosed. (With these kind of figures it was little wonder they
were so busy).

The number of persons registered with SOUD each year:

1977

2,600

1980

31 ,944

1981

13,699

1982

22,652

1983

16,400

1984

13,959

1985

18,476

1986

25,967

1987

21 ,062

The MfS wanted to make SOUD a multilateral control organ with rights. In general,
it was felt important to standardise the technical equipment of each service - a
requirement not achieved, and the exchange of information needed improvement.
An important advantage of SOUD was its ability to cross reference an individual
who may be a suspect of more than one agency. But operational ability fell below
expectation. The data in SOUD was often out of date, some members stated that
perhaps only 25% of information was usable. In 1986 & 1987 SOUD received
114,000 inquiries, and gave out information about 10,500 individuals. They also
had more than 1 ,300 topical inquiries. The number of inquiries was rising all the
time. Other weak points were the form filling and concerns about the protection of
data. The MfS praised the use of SOUD in the identification of US citizens
(journalists or embassy personnel) who visited the GDR for short periods of time.
The MfS also stated that SOUD should be used more to combat internal
opposition.

The leader of the Bulgarian delegation announced that they had registered around
1,700 people in the SOUD system during the previous year. Most of the PK1,
working for the American, Turkish or Greek service. In 1986/87 they made 5,000
inquiries and received positive answers to 7.5%. They made 48 topical inquiries
and received 50% positive answers and information about 1,100 people.
Information had also been gathered about Western services whose members had
attended meetings in Bulgaria.

Vietnam advised that they were to maintain their manual systems of working and
that they had little knowledge of modern technology. They also requested the
inclusion of information concerning citizens in Thailand - this was agreed.

The Cuban delegation confirmed that they were satisfied with the effectiveness of
the "flash" inquiry system receiving an answer in 24 to 36 hours. Mongolia said
they had less use for SOUD in their country, as they had little contact with foreign
countries.

The next meeting was scheduled for 1990 in Budapest.

"BORED & LAZY PEOPLE MEET BABBLERS 1

♦ INTRODUCTION

Only in ENIGMA could you get a title like that! In the last issue (1 4) we requested
information about several stations which could be monitored in the United States.
One of the successes of ENIGMA has been our ability to untangle stations by
identifying formats and habits. Operating from England and concentrating on the
European, Middle Eastern and C.I.S. areas, information about more distant stations
is often scant. Thanks to our readers in the U.S.A. we are pleased to be able to
bring you more information about two stations which have eluded the newsletter
until recently.

♦V20THE BORED PEOPLE

The first is new designation V20. This station will now be named The Bored
People (incorporating the other descriptions sometimes used of Lazy Man). V20 is
actually referred to more commonly as the "Bored Man" in the United States, not
Lazy Man, due to the monotonous nature of the transmission format and resulting
tendency of the announcer to yawn during broadcasts. In winter the schedule
reported is SUN at 15.00 UTC & WED at 21.00 UTC on 6868 kHz and on MON at
20.00 UTC on 6892 kHz. In summer it appears one hour earlier than UTC when
Cuba is on summer time and has been noted at 14.00 UTC on SUN on 5135 kHz.
Test’s have also been heard on 41 06 kHz. V20 appears to operate a low power
transmitter, which accounts for it not being widely heard. The technical aptitude is
also somewhat lacking; maybe explaining why the station sometimes skips
broadcasts. The Bored Man does periodically put out a clean signal. However, this
is the exception, rather than the rule.

The format of V20 is as follows: On the hour, a live Male or Female (Bored
Woman!?) announcer will repeat the following for approximately thirty minutes...
"Atencion, Atencion, Atencion; Ere Dos Noventa; Un, Dos, Tre, Cuatro, Cinco, Sies,
Siete, Ocho, Nueve, Diez". On one occasion the operators counted from one to
twenty. This may or may not be significant to the message. The announcer will
often change during the broadcast. Note: last 2 figures are not read out as
separate digits, and letters are not read phonetically but by their Spanish names.

The message is, "Ere Dos Noventa” (R290). The R290 message is sent 90% of the
time. Also noted are "X301'', "X321", 'X375” and most recently “C791". The entire
transmission follows this simple format (on some occasions salsa or classical
music is played between counts) and ends abruptly after 30 minutes with “final
final”.

Some reports suggest a pause between the first and second digit creating a
"C7-91 " message.

Two schools of thought exist as to the possible agency behind this transmission.
The first indicates that the station may be operated by anti-Castro groups or
guerilla forces from inside Cuba. Ed note: Unlikely as Cuban authorities would
have found it before now. If anti-Cuban must come from outside Cuba, maybe
Florida. On most occasions, there is a lot of conversation and laughter going on
in the background. Once last summer, however, the announcer sounded like he
was in stark terror. He was literally yelling the message, and was talking so fast
that he was tongue-tied after just a few minutes. You could ’feel’ the fear in his
voice. Ed note: If live and under threat why risk such long transmissions - after ail,
long messages are not being sent?

The second school of thought points to links with official Cuban Forces. If you
listen carefully, you can hear Morse code going on in the background "studio"
noise during some transmissions: this has been paralleled to CW nets on 5258
and 5485 kHz which appear to be run by the Cuban army and are audibie in the
Southern United States. Ed note: Alternatively, they may not be Cuban at all - there
is no evidence to say they are. Could be any Latin American country.

Although evidence is lacking it may be possible that another station listed by
ENIGMA -VI 9 may be a relation. A recording of a Spanish Male accompanied by
the music ’Don’t Cry For Me Argentina’ and callsign WTR21 was noted in the
mid-1980s by Christain, a biind listener from Germany. (This recording can be
found on the Conet project CD). Like certain other stations it was only heard on
one occasion so the recording is particularly valuable. The tune was played three
times and the message commenced with the caiisign WTR21 (the range WAA to
WZZ are allocated to the U.S.A.). The message was of a peculiar format the first
three digits e.g. 431 were announced - ’four hundred and thirty one’ followed by
two digits 32 - announced ’thirty two’ but in Spanish. This was followed by a short
break and the whole message was repeated but this time as the more familiar
single numbers. The transmission ended ’fin’ and the cal! VYTR21 was again
repeated.

*V21 THE BABBLER

From Bored People to Babblers and another new designation V21 . Some doubts
have been raised as to whether this really is a numbers station - but we will give it
the benefit of the doubt until evidence is more conclusive. Other reports indicate
that it may be associated with the above listed V20 - more on that later.

The Babbler has it origins back in the 1970s. The message consists of a Spanish
man or woman, live transmission, chanting or singing a repeating string of
numerical groups which are usually 2 or 3 digits per group: the "long " form of the
groups is read, i.e. "145" will be read "Ciento Cuarenta y Cinco" rather than
individual digits. The same string is read repeatedly, with individual group values
varying somewhat, suggesting something similar to "voice telemetry" being sent
rather than encrypted text messages. According to some retired SIGINT
professionals, this is the format used by former Soviet Air Defence CW nets for
target tracking information; so, this could be a similar operation by the Cuban

DAAFAR (Anti-Aircraft Defence and Revolutionary Air Force). This would make it a
primitive analogue to the NATO "Alligator" Link systems.

Lots of “long count" tests are conducted. Frequencies are changed infrequently but
inevitably. The primary frequency in recent months has been 5688 kHz, but since
January 1 998, 5637 kHz has become more active. Others noted include 5643 kHz
and 5341 kHz which is still in use primarily for test purposes. The frequencies are
rather random, but particular frequencies are usually active for a month at a time,
and then gradually replaced by another, with a period of both frequencies being
active.

Each frequency appears to employ different transmitter sites from day to day, as
audio quality and signal strength vary wildly; either AM or SSB may be used on
any given frequency. Transmitters are fed by land-line circuits, lots of hum, dialling,
and crackling may be heard at times. Operation is sporadic; local Cuban mornings
are the most active periods, but traffic may be heard at any time during day or
night. Sometimes other Cuban voice communications are heard on the same
channels; this is the case with both 5688 and 5637 kHz. Up to four channels have
been noted active simultaneously with independent content, but one or sometimes
two is more typical. Occasionally, tests on multiple frequencies, including some
new and some long-dormant ones, will be heard during the last week of the
month, but this doesn’t appear to happen monthly. The lowest frequency noted
was 3040 kHz, the highest was 8090 kHz, with most between 4 and 7 MHz.

Speculation about the transmissions varies with reports that V20 and The Babbler
are related. Reports indicate that a V20 transmission was heard in the background
of a Babbler transmission. Digital data has also reported being sent by The
Babbler.

During the early 1980s, at least one Babbler station was possibly a "black"
operated by the American side. The station was on 3646 kHz at night time (in USA)
for several months, utilising the usual format. One night, some audio from a Key
West, Florida FM station found its way into the transmitter and was relayed for
several hours in the background. The following night the station made a big show
of relaying the Russian "Mayak" programme at full modulation from Havana. Draw
your own conclusions from that one.

At present this is all the information we have on these stations. We are always
pleased to receive more information and comments.

Our thanks go to readers in the United States, Chris, John and a reader who
wishes to remain nameless for providing the information and cassette recordings
which made this feature possible.

Chris ends: "Sorry these stations don’t fit into the nice rigid formats that many
European numbers stations do".

LOOKING BACK with , D >

Czech Mate - The Case of Erwin van Haarlem

On the evening of 2 April 1988, Special Branch detectives raided a third floor flat at
35 Silver Birch Court, Friern Barnet, North London. Inside they found Mr Erwin van
Haarlem a 42 year old "Dutch" art dealer receiving a coded CW message on a
shortwave receiver. This was the end of one of the strangest spy cases in recent
years and followed months of surveillance by MI5 on his home and daily
movements.

The story started in 1944 when Mrs Joanna van Haarlem had a liaison with a
German soldier in occupied Holland^ and the product was a child later christened
Erwin. The father died in the battle of Caen, and the mother was shunned by her
family due to her relationship with the German, and the fact that she was Jewish.
Unable to look after the child, she left him with the Red cross in Prague who said
that they would find him foster parents. She had no further contact with the child.

in May 1975 a man calling himself Erwin van Haarlem arrived in Britain on a Dutch
passport to work at the Hilton hotel in Kensington. He was in fact an illegal
undercover agent employed by either the Czech intelligence (StB) or Czech
military intelligence (SFGF) to spy in Britain.

ft appears that he was sent to Britain to spy on Jewish dissident groups and
collect information on companies participating in the "Star Wars" programme. The

true nature of his work, though, may never be know as MI5 admitted at his trial
that they did not know what he was doing in the UK for 1 3 years, and indeed did
not know who he really was. It appeared that a high quality illegal agent would not
be solely used for this sort of open source collection duty and perhaps was a
"sleeper", an illegal who would be activated in wartime. His cover was nearly blown
in 1977 when the mother of the real van Haariem came looking for him, and for a
number of years she believed that this man was her son as he gave her
heart-breaking stories about his early life. A DNA test following his arrest revealed
that there was only a 1 : 18,000 chance that he was her son. The fate of the real
van Haariem is unknown. One report said that he had died as a child in Prague.

Erwin continued working at the Hilton as the purchasing manager until 1985 when
he set himself up as an art dealer specialising in miniatures. This presumably
would give him more time to deal with his real job as he was self-employed and
could spend much time travelling and working from home. It also meant that he
could run his routines around his radio broadcasts. Nobody in the art world had
heard of him. He also had thousands of pounds of unexplained income, £54,000
having been paid into TO bank and building society accounts. In 2 years he
deposited over £17,000 in his accounts, and an accountant found that pictures he
said he had sold were still in his possession. The business was just a "front" to
conceal his real activities, and he produced bogus paperwork to make it look as
though the business was running normally.

People who knew him described him as a "pleasant oddball", and the landlord of
his flat in Alderney Street, Westminster noticed that he changed the locks to the
doors and kept the keys to himself. In Friern Barnet, the neighbours noticed that
he did not have visitors and rarely spoke to anyone. He was very interested in
Jewish affairs and pretended to be Jewish, even twice visiting Russia with a protest
group, as he could speak Russian. He spoke English with a mid-European accent.
He visited the US to obtain information on Jewish affairs and on the National Task
Force, as well as making 3 trips to Austria.

It appears that Erwin was Czech and had probably joined the StB after military
service. He was then trained for 3 years before being sent to Austria and then to
England, in Austria he was engaged on "orientation” duties to adapt to the West
before moving to the target country. He worked first as a waiter and then attended
a catering college to build his cover.

"Mr Erwin van Haarlem aged 43, is accused of a breach of
section seven of the 1920 Official Secrets Act by doing an act
preparatory to the commission of an offence under the 1911
Official Secrets act on April 2. He is accused of recording
enciphered information and being in possession of equipment to
decipher that information for the benefit of a foreign power".

"They arrive covertly with someone else's identity. They have
no past intelligence background and have never been posted to
an embassy in the West. MIS has no way of knowing who the
illegals are unless they make a mistake or are caught
electronically - trapped by the sophisticated "ears" of GCHQ.
Through its listening centres GCHQ had detected incoming high
frequency Morse code signals from the Prague area for a long
time. It was stated in court that van Haarlem was known to
have received 200 coded signals in 13 years” .

Little about his activities was revealed at his trial, but it is known that he was
controlled by numbers in the form of Morse code sent from Prague. His radio was
a popular SW receiver and was manually tuned. In 15 years he received 200 CW
messages in 5 figure groups. These were decoded using one time pads. Three
unused pads were found hidden in bars of soap which had been hollowed out.
Three other one time pads were found hidden in his flat. It was one of these
messages he was receiving when he was arrested, and several messages were
read out in court. All the others remained impregnable. The messages read,
"Prepare your report for hand over in Vienna, repeat Vienna. Indicate how you use
the microfile". "Regarding immigration , use your initiative". A second message read
“Send only news about intended actions against the Czech Socialist Republic".
Magazines in the flat contained addresses in Czechoslovakia, and there were
chemicals for writing secret messages. In a wallet was a slip of paper which
contained lists of coded dead-letter-boxes for leaving information. One which was
code-named "Marx" was at the "Minstrel Boy" public house in Colney Hatch in a
broken wall. Another was by a line of poplar trees on the edge of a golf-course.

4 ©

Further information was found on how to obtain British nationality, Social Security
help and birth certificates. It appeared that the only contact he would have with
the Czech Embassy was via the illegal*’ support officer, but everyone in the
Embassy denied all knowledge of him. Upon his arrest he asked the police to
inform the Czech Embassy that he had been arrested.

"A spokesman for the Czech embassy yesterday continued to deny
having heard of him” .

How he was caught was not revealed but it is believed that a Czech defector gave
him away, and his second trip to Russia had drawn the attention of immigration
and Special Branch. A surveillance operation was mounted, lasting many months .
Finally, when MIS realised it had found its man, it launched an even bigger
operation to gather evidence against him. A flat overlooking the back of his
address was taken over by MIS in August 1987. They used binoculars, probe
microphones and telephoto lens cameras to watch him. His phone was tapped and
his flat bugged as well as him being followed constantly.

"Neighbours spoke of a mystery team of people who moved in to
a flat overlooking van Haarlem's. The men were seen carrying
electronic equipment. Then, two days before the swoop, a
suspicious builder's van stayed parked outside the Czech's
flat” .

The team in the flat consisted of four men and a woman who so alarmed

neighbours that they informed Special Branch! A strange loop aerial had been put
up and people said they saw lots of equipment in the flat as well as dense net
curtains. They made lots of noise and spent much time moving heavy equipment
around. The battery operated clocks in peoples’ flats either stopped or went fast.
People also found interference on their televisions with dots and dashes on the
sound. Van Haarlem refused to tel! investigators what information he had
transmitted by Morse code to his "control" in Prague from his flat.

"Mrs Saint, 61 who coordinated the Neighbourhood Watch Scheme
said she and her daughter had telephoned the police in
November but were dismissed as nosey neighbours. She said that
shortly after they moved in she heard strange noises and was
perplexed by the "Morse code” interference which affected her
TV set every night at 9.20. Mrs Saint's curiosity grew after
she spotted her mysterious neighbours (MI5/Special Branch)
carrying what looked like a box of electronic equipment into
the flat. At first she thought it might be a computer but
began to have her doubts when each night she noticed the
strange TV interference” .

She added: "At one time there was a lot of banging about and
when I went to complain they seemed very anxious to know
whether we had been able to hear what they had been saying.

"The man who answered the door claimed it was being used by
his engineering company as a temporary office. “When I replied
I knew something about that because my father had been a
bridge builder, he gulped and became very flustered. There
were other odd things too. For example, every morning at 6 A.M.
their telephone would ring and this was answered immediately.
"At Christmas, I went to the flat and asked if they would like
to join us for a drink. The man who answered the door, peeking
through a crack, thanked me but never turned up.”

Three weeks after his arrest, the surveillance team moved out.

The authorities could not prove what he had passed on to his bosses or even that
he passed any information on at all. What he was convicted of was the possession
of the means to receive and transmit ^secret information and this earned him a ten
year sentence in Parkhurst prison. He only served a fraction of his sentence as he
was deported in 1992, probably due to the good relations now existing between

the UK and Czechoslovakia. Perhaps he sent Mi5 a postcard Any

additional information about Erwin van Haarlem past or present would be
appreciated.

Acknowledgments: Rob Evans for providing newspaper reports.

Court told of 200 coded messages

Czechs
deny link
with spy
suspect

from Prague f

“ ~~ 1 " /Neighbour’s^

MI5 SWOOP TV picked up

nets a spy j Morse code

‘Star Wars spy’ caught
receiving code message

ch «s

TIOSt

niza-

ever
csuc
■n as
d a
ic to
ail
sed

, Eastern bloc illegals always spend ume
I in the West to orientate themselves before
| infiltrating the country selected as a target

6 GCHQ had detected
incoming signals from the
Prague area for a iong time 9 j i

for espionage. Van Haarlem spent more l c
than two years in Austria working as a j-
waiter an d then attending a eaten ng schoo l < ^

Drse code s]_
^caught in act’

- By John Weeks

A SPY for the Czech secret service was caught in thi f
act of receiving a coded Morse message from his mas{ r

M23 - The "ODD-EVEN STATION” (Part 1)

At last we have got round to featuring M23, a major numbers station without a
family, and with some very peculiar habits. Not for nothing is it also known as the
Chameleon station, for it has a bewildering variety of format variants. NO OTHER
STATION OPERATES IN THIS WAY.

Transmissions are all in ICW, and use a quite distinctive 'staccato’ auto-keying, where
the relative lengths of dots, dashes and spaces aren’t quite like those of other stations.
A long zero is used, giving a clue to origin. The only other major stations using long
zeroes are M4 (Swedish Rhapsody) and the now defunct M2 - NNN’s busier morse
'arm’.

Basic Format

Very loosely, we can say that there is a 'primary’ format, which occurs slightly more
regularly than the others. Formats can vary to such an extent that the only thing two
transmissions may have in common is the 'core’text, and its repeat sequence. Calls
and endings can vary considerably. This 'core’ text element, the message, consists of
single 5f groups, of which some are not random. Usually, but not always, the first
group is identical to the last (both included in GC) and usually this contains at least
one zero, generally in the fourth place. The penultimate group is also significant in
that it usually has zeroes in its last three or four places, and has even been 00000.
These non-random groups clearly play no part in the message itself, and probably
contain decryption instructions, the DK being part of the first/last group. (We’ll have
more to say on this later). Group counts tend to be in the medium range, averaging
around 40.

This 'primary’ format is one of the odd/even formats, where the lQmin cal! is made
up of a 3f schedule number which also serves as a null message indicator. Generally,
3 odd figures, e.g. 391, indicate that no message will follow, in which case the call cuts
off abruptly after 10 minutes. However, when a message is to be sent, the call
changes to three even numbers, e.g. 486. After 10 minutes, a pause is followed by =
= (GC repeated once) = = (message follows) ==??== (GC, again sent twice)
= = (repeat of message) = = AR AR.

We’ll cover numerous variants in Part 2.

Scheduling

Scheduling is as varied as formats. Again, we’ll only discuss here the 'primary’
scheduling pattern, which is a little more frequent that the others. Two parallel
frequencies are used, often chosen from a favoured selection. Parallels aren’t
consistent - one freq may share with several others at different times.

This tendency to use 'favoured’ freqs. helps towards identification, seeing that
formats cannot be entirely relied upon.

'Primary’ schedules keep the same schedule numbers (odd or even depending on
status) throughout their lives - (many other schedules do not). They operate daily or
twice daily, usually on the hour, occasionally on the half-hour. Timing is hardly a
strong point - transmissions may begin anywhere between h-3 to h+5min. Messages
on these 'primary’ schedules come under the rare/occasional/never category. i.e. the
vast majority of calls use odd numbers. These schedules have lives which may vary
from a few days to a year or more. The longest-running schedule we know of is still
with us, having begun in February 1997: ID 579, 0800 & 1400 on 8307//9285. No
messages have yet been sent. It is possible that some of these schedules never send
messages, and act as some kind of daily status indicator. None of the schedules,
primary or otherwise, have been found to follow any kind of cycle - never
reappearing, say, a year later. Few stations behave in this way. This implies that they
all relate to specific 'missions’, which don’t coincide with regular 'tours of duty’.

Frequencies noted so far: 3380 4630 4767 4800 4825 4893 5019 5080 5180 5349 5400
5540 5625 5665 6290 6520 6560 6870 6918 6999 7504 7520 7795 7830 7850 8307 9285
10200 10775 11346

Those underlined have been in use for many years. Possibly they all have, maybe
some having years of intervening inactivity between one schedule and another.

Signals are usually strong in Europe, and transmitter faults and errors (apart from
late/early starts), are unknown. In the next part we will attempt to cover the many
variants of this station, and some of its wierder scheduling patterns.

239 - 03607 57063 56355 31143 15660 18963 22567 86865 87334 05913

87499 50150 78340 72725 44423 63534 11748 25049 38868 97579

15265 03634 63049 27566 98613 00863 57480 16911 81807 15975

42616 60160 88723 65791 77295 38561 90542 64836 99462 13181

09873 45062 85492 59527 86391 33731 86935 05040 70316 38267

88689 96217 77845 26260 57285 45618 99392 44631 78328 94949

95637 23174 81050 78351 78888 41482 51724 89002 54738 14141

70572 56529 28403 75830 17399 26227 95744 12368 55734 36289

40403 18272 67831 54724 98562 06826 77381 84531 09573 90600

60327 49408 37148 60078 87994 25501 01549 92062 54774 64940=

718 - 8/621 9/984 10/029 11/115 12/232 1/677

111/6 111/7

"PAR CE SIGNE TU le VAINCRAS" nous disons...

J - 111/ 27/2
DZ - 111 13/3

PQ - 000

24/3 15/4 29/4 28/6 504

14/3 30/3 7/4 19/4 20/5 23/5

27/6 944

NEWS ROUND UP - REPORTS OF INTEREST

► RUSSIA - FOREIGN SPIES ACTIVE IN St PETERSBURG - The results of the
work of the Federal Security Service (FSS), in the opinion of the head of the
directorate of the FSS for the St Petersburg and Leningrad Region, Viktor
Cherkesov, "shows that foreign intelligence services are active in our country and that
Russian special services have the opportunities, capabilities and means to combat
them". The FSS had discovered and unmasked 29 agents of foreign intelligence
services, which is in line with the postwar level.

One inhabitant of St Petersburg was found guilty in 1997 of treason and working for a
foreign intelligence service with a system of tasks and proven acts of passing
information. One other case of a Russian citizen cooperating with a foreign
intelligence service came to light with the help of the local FSS directorate’s
confidential telephone line (278-69-93), which has received 400 calls in the past four
months of its work. Every one of these calls resulted in the necessary consultation or
check. A ’’resident agent” made a call on the confidential telephone line which made
it easier for him to escape from the tutelage of his foreign recruiters.

► LITHUANIA - IN TELLIGENCE CHIEF CALLS FOR BETTER FUNDING - The
head of the Lithuanian State Security Department, Jurgis Jurgelis, has called for
better funding for his service. In an interview in the ’Lietuvos Rytas’ newspaper,
Jurgelis said that counter-intelligence, security and analysis sections need to be
expanded in particular. Fie admitted that the formation of an investigations service in
the Ministry of Internal Affairs had weakened his department. Some divisions had
lost many of their staff, including badly needed computer experts. Jurgelis said that
the department had had successes in countering foreign agents in Lithuania and in
conducting intelligence work abroad. The service claims to have detected safe houses
(of intelligence agents) from several countries. Foreign spies in Lithuania are
employing their usual cover: diplomatic, commercial and media. The exact number of
staff employed by the service cannot be disclosed but they are now employing more
women in the service. It was also stated that ihe Lithuanian intelligence service
conducts activities abroad. We gather information about the political, economic and
military situation in neighbouring countries. We pay special attention to the analysis
and assessment of outside threats to Lithuania. We get a great deal of information
from analysing the press, as well as the radio and TV broadcasts of those countries.

► POLAND - RUSSIA REJECTS SPY ALLEGATIONS AGAINST DIPLOMATS IN
P OLAND - A report in the Warsaw Daily Newspaper ? Zycie ? claims that a list of 23
Russians who - according to anonymous informers were or are Russian intelligence
agents. The majority of the Russians on the list have left Poland, but four remain.
The brain behind the ring was the Russian ambassador in Poland, Yuriy Kashlev, who
already ended his mission to Warsaw. The newspaper thinks that the Polish
counter-intelligence service is helpless in the case: the Russians have technical
resources many times in excess of those of the State Protection Office. The head of
the press service of the Russian Foreign Intelligence Service Gen. Yuriy Kobaladze
calls the revelations by ? Zycie’ ridiculous and untrue. He did, however add ”we are
indeed interested in your country but our agents are not doing anything in Poland
that Polish intelligence would not do in Russia".

► BELARUS - SECURITY CHIEF CONCERNED OVER POLAND'S ALLEGED
INCREASE IN SPY ACTIVITIES - Minsk. "The Polish special services have started
mass recruitment activities among Belarusian citizens," Chairman of the State Security
Committee (KGB) Uladzimir Matskevich stated. He also said he was concerned that
"an increase in this activity is under way". A larger number of Belarusians have turned
to the KGB for assistance, he said. These facts testify "to a certain policy (pursued by
Poland) at state level", he said. This activity by the Polish special services cannot
continue forever and assume a scale threatening the national security of Belarus.

► BRITAIN - PLANS FOR BRITISH EMBASSY IN UKRAINE ABANDONED - Plans
for the new British Embassy in Kiev had to be abandoned after the Ukrainians had
asked HM Government not to go ahead. Reports indicate that the neighbour of the
embassy would be no other than the Ukraine President, Leonid Kuchma. According
to the Ukrainian Newspaper "British Diplomats might not be able to resist the
temptation to listen to every word the president and his family said".

Our contributor says - I for one cannot think of anything so
ungentlemanly as to eavesdrop on someone else conversation!

► BRITAIN - MUSEUM OF SECRETS AT DEFENCE INTELLIGENCE CENTRE -
Recent revelations about Britain’s best kept secret museum have recently come to
light. It is located at the classified Defence Intelligence & Security Centre at
Chieksands, Bedfordshire. The museum does not advertise itself. Its telephone
number is not listed, nor available from Directory Enquiries. Local tourist information
does not include its details. The museum is devoted to field intelligence, surveillance,
observation, map-making and sketching, and from modem times, the interpretation of
aerial photography.

The first of its two rooms traces the history of the Intelligence Corps from Henry
VIII, who created the post of Scout-master ’to search and view' that there be no
enemies laid privily for annoyance’. The second room is rather more dramatic and
houses the private Medmenham collection of aerial photographic intelligence
materials. There are models of D-Day beaches, an exhibition of Operation Bodyline
(which targeted the VI and V2 rocket bases), a giant air camera, and modem light
tables used to create minute accurate imagining from aeriai photographs.

The museum has been asked to contribute to Bedfordshire’s Millennium celebrations,
but is unlikely to be a serious competitor to the Millennium Dome, although its
contents may well offer more education.

The Defence Intelligence & Security Centre at Chieksands was formally known as
RAF Chieksands - a cover name for the base which was part of the United States
NSA operations in Europe. The base used to be home to a huge Wullenweber
direction finding antenna (AN-FLR/9) which is now dismantled and the site now
houses the new Special Wireless Section. Also of interest is a new shooting range, and
a Psyops section, moved from MI6’s training centre at Ashford, and expanded. The
base is now home to the DIS which has two main parts, the Defence Intelligence
Analysis Staff (DIAS) in Whitehall, and the Intelligence and Geographic Resources

Staff (IGRS), which has a headquarters element collocated with the DIAS, but the
bulk of whose staff work in three DIS Agencies outside London.

These are the Defence Intelligence and Security Centre (DISC) based at Chicksands
in Bedfordshire, the Joint Air Reconnaissance Intelligence Centre (JARIC) at
Brampton, Cambridgeshire, and the Military Survey mainly based at Feltham
Middlesex. The purpose of DIAS is to carry out All-Source Assesment using
information gathered both in an overt or covert manner and to provide information to
the MOD Ministers and Central Staffs, operational commands, the Permanent Joint
Headquarters, NATO and other government departments.

If you are interested in visiting the museum do not simply turn up, but book your visit
by telephoning UK 01462 - 752340, mentioning ENIGMA may not improve your
chances of obtaining a pass!

► CHINA - CHINESE SATKTJ.ITE SUFFERS JAMMING A mysterious signal
hitting a Chinese telecommunications satellite is disrupting share trading, earthquake
monitoring systems, and pager services in China. Technicians had ruled out a problem
with the Apstar-1 orbiter which had "suddenly received a signal of neutralizing
interference from an unknown outside source," investigators had not ruled out that
the Earth based interference was the result of an attack by domestic or foreign
saboteurs. The disruption reportedly affected more than 400 securities and futures
companies and 100 paging services, cutting off services to more than 10 million pager
users. The use of satellites present their own series of problems and many countries
maintain back-up HF systems (some like HEP and the large French network
FDY/FDC etc. are still heard reserving channels, while other HF transmitters and
feeders are moth-balled. Several recent events have again high-lighted the
vulnerability of space communications. The United States are testing a laser beam
which can be fired from earth simply blasting foreign intelligence satellites into
oblivion. Recent TV reports indicate a test firing at an ’old’ communications satellite.
A gleeful US official described the system as capable of destroying something the size
of a refrigerator from an Earth using the laser beam.

► BRITAIN - RAF TESTS jamming TRANSMITTER - A report carried on BBC
Radio 2 news (and dropped from later bulletins) indicated that the RAF were
conducting tests to deliberately jam the Global Positioning Satellite System (this
allows any user to determine their position very accurately anywhere on the planet
using only hand held domestic equipment). The report indicated that the system
would be jammed in the event of (unspecified) conflict. During WWII Britain
removed all its road signs in the event of an invasion, with a view to slowing down the
enemy. Any attempts by enemy agents to travel around the UK now would surely be
severely hampered by road works if they did eventually get off the M25!

► BRITAIN - ASCENSION ISLAND HOME TO ELECTRONIC SPIES Until 1982
virtually no one in Britain had ever heard of the Falkland Islands. Until then, Prime
Minister Margaret Thatcher launched a mini-war to recover them from invasion by
Argentina. Today fewer still will have heard of Ascension Island, a lump of volcanic
rock situated 1,600 miles from Nigeria and 1,500 miles from Brazil in the middle of
the Atlantic ocean. The location of Ascension and its unique administration makes it
ideal for secret activities. There are no native people of Ascension at all. The island is
a British possession and access is strictly controlled; passing yachtsmen have to obtain

5"5

permission to spend a night on the Island. The RAF are present and the Americans
on the Island manage the huge airfield they built 50 years ago. The Island is home to
the relay transmitters of the BBC World Service (operated by Foreign Office
employees). Once the broadcasters had proven the value and isolation of Ascension,
the electronic spies turned up, too. The Island they found, was a static free, people
free listening post from which they could eavesdrop on every telephone call and radio
message being conducted in Africa. A huge and deeply secret intercept station was
built. According to recent reports it is "an Island crammed and jammed with fizzing
aerials and humming radar domes and nodding scanners and blinking lights, with
machinery that is working ceaselessly tor spies." Sounds like the ideal Numbers
Station location.

► LUXEMBOURG - EUROPEAN PARLIAMENT DISCUSS "ECHELON " - A recent
report confirms for the first time the existence of the secretive ECHELON system,
confirming that the citizens of Britain and other European states are subject to an
intensity of surveillance far in excess of that imagined by most parliaments. The
report - Assessing the Technologies of Political Control was commissioned by the
Civil Liberties Committee of the European Pariiament. It contains details of a
network of American - controlled intelligence stations on British soil and around the
world, that "routinely and indiscriminately" monitor countless phone, facsimile and
email messages. It states: "Within Europe all email telephone and facsimile
communications are routinely intercepted by the U.S.A. National Security Agency
transferring all target information from the European mainland via the strategic hub
of London then via satellite to Fort Meade in Maryland via the crucial hub at
Menwith Hill in North Yorkshire". The report confirms for the first time the existence
of the ECHELON system. Until now, evidence of such astounding technology has
been patchy and anecdotal. ECHELON is designed primarily for non-military targets:
governments, organisations and businesses in virtually every country. The system
works by indiscriminately intercepting very large quantities of communications and
then siphoning out what is valuable using artificial intelligence aids like MEMEX to
find key words. Claims have also been made that ECHELON automatically analyses
most email messages for "precursor" data which assists intelligence agencies to
determine targets. According to former Canadian Security Establishment agent Mike
Frost, a voice recognition system called Oratory has been used for some years to
intercept diplomatic calls.

One of the NSA’s bases, Menwith Hill, is the biggest spy station in the world. Its ears
- known as radomes - are capable of listening to vast chunks of the communications
spectrum throughout Europe and the former Soviet Union, in the first decade the
base sucked in data from cables and microwave links running through a nearby Post
Office tower, but the communications revolution of the Seventies and Eighties gave
the base a capability that even its architects could scarcely have been able to imagine.
With the creation of Intelsat and digital telecommunications, Menwith and other
stations developed the capability to eavesdrop on an extensive scale on facsimile, telex
and voice messages. Then, with the development of the Internet, electronic mail and
electronic commerce, the listening posts were able to increase their monitoring
capability to eavesdrop on an unprecedented spectrum of personal and business
communication. This activity has been all but ignored by the UK Parliament. When
Labour MP’s raised questions about the activities of the NSA, the Government
evoked secrecy rules. It has been the same for some 40 years.

5 <*

► ISRAE L - THB BRIGHT SIDE OF FOOT, UPS - Mossad has been big news
recently. At least one (four were implicated) Mossad agent was recently arrested in
Switzerland in a bugging operation which went awry. Last year Mossad agents
operating in Jordan injected Khaled Mishal an Hamas leader with poisonous
chemicals and only intervention by King Hussein forced Israel to supply an antidote
to save Mishal’s life. The attempt on Mishal’s life failed when, instead of spraying the
toxin into his ear, from where it should have travelled to his brain, causing
haemorrhage and death, within six to eighteen hours, the poison struck his neck and
collar. If things could not get worse Mossad agent Yehuda Gil was arrested after it
was revealed he had supplied false intelligence reports, the results of which could
have been almost sufficient to start a war between Israel and Syria. The combined
effect has been the resignation of Mossad head Danny Yatom.

Problems at Mossad go back many years. In 1991 four Israelis were arrested during
an attempt to bug the Iranian embassy in Nicosia in the dead of night. The four,
widely reported to be Mossad agents, claimed they had been looking for a lavatory.
They were released on payment of $1,000 fines. Norway is also requesting that they
be allowed to interrogate a former Mossad agent over his role in the assassination of
Ahmad Bushiki, a waiter holding a Moroccan passport. Bushiki was mistaken for FLO
security officer Ali Hassan Salameh. In 1993 Mossad admitted, "We never spared any
effort to spot the real target but Salameh and Bushiki were so identical that one
would think they were twins".

Scarred, tattered and temporarily headless, it would seem the once vaunted and
mysterious Mossad is heading for the doghouse - exactly where spy agencies go when
they don’t shoot straight, fabricate intelligence reports and can’t even tap a phone
without getting caught. In a country where people are drawn to elite units, it appears
the Mossad will have to make some drastic moves to invigorate its ranks and pull the
best of Israeli youth into an organisation whose successes are shrouded in fog and
whose failures are fodder for the media. Or does it?

Experts and former Mossad officials say that exposure, even bad exposure, can
actually enhance the agency’s image. "There is the flip side of all this," said Joseph
Alpher, a former high-ranking Mossad official. "Publicity around certain activities may
attract people who want to do this kind of work." But the increasing number of
headlines detailing mishaps actually expose some of the Mossad agents real tasks.
They really are going after terrorists in Arab countries. They really are in Europe
eavesdropping on the enemy. They really are meeting with operatives in Parisian
cafes. "Everybody knows that if a mishap happens then it means the Mossad is very
busy. When you are busy and doing a lot of operations, then inevitably there will be
mishaps. The only way to really tell if the failures have had an effect is to get the
figures on recruitment into the Mossad. Don’t hold your breath waiting for that
statistic.

► CUBA - MORE REVELATIONS FROM GRU DEFECTO R * The Cuban military has
long run its own smaller but much more secret version of the Russians’ Lourdes
electronic spying base, a unit known as the Electronic Warfare Battalion. Cuba does

not get copies of the communications intercepted at Lourdes, only copies of Russian
intelligence summaries on issues that could affect the Island’s security^ said Stanislav
Lunev, 50, a former colonel in Soviet military intelligence (GRU) who defected in
Washington in 1992 while working as a TASS news agency correspondent.

Adjoining the Russian base at El Wajay, nine miles southwest of Havana, is a
Cuban-run "parallel signals intelligence operation". It is not clear just how powerful
this centre is, but the defector said it could certainly pick up telephone and radio
signals from Miami, 130 miles to the north. The Interior Ministry’s General
Directorate for intelligence runs a separate radio listening and transmitting post
elsewhere on the Island, apparently to stay in touch with its spies abroad, the defector
added. The report also indicates that the Soviet Union learned of U.S. battle plans in
the Persian Gulf War in 1991, including the surprise "left hook" into Iraq, through the
electronic spy network in Cuba. Moscow did not leak the plans to Baghdad at the
time, but improved Russian ! raqi relations may lead Moscow to be more friendly to
President Saddam Hussein. Lunev said he had learned that Moscow was aware of
Pentagon war plans when his GRU superiors asked him to analyse possible U.S.
strategies based on secret cables sent by Moscow to the Soviet Embassy in
Washington in late 1990 and early 1991. The cable summarised intercepts of U.S.
communications, from chatter of U.S. warplane pilots in flight to the private
telephone conversations of soldiers and their families. Lunev said he knew the
information was from intercepts at Lourdes because of their coding, and because
friends and officials at the GRU in Moscow had told him so when he had a holiday in
Moscow soon after the war.

Lourdes also receives and collates intercepts by spy satellites, ships and planes in the
Atlantic region, making it a fully fledged regional command and control centre with
some 2,000 Russian staff. U.S. officials reportedly suspect that Russian intelligence
agents have recently been spying on the U.N. teams inspecting Iraq’s chemical and
biological weapon sites, apparently to help Baghdad.

Moscow’s Lourdes spy centre in Cuba which was built by the GRLJ in the 1970s is far
bigger than publicly known, a "monster" that collates data intercepted by Russian spy
satellites, ships and planes in the entire Atlantic region. A CIA spokesman would not
comment on the claims but other U.S. Intelligence experts said Lunev’s description of
Lourdes was on target and that he is a serious defector who has lectured at the
Pentagon, CIA and NSA, which is in charge of U.S. electronic eavesdropping.

► BRITAIN - SPYING OUT A MEW POSITION - Britain’s spymasters are
recruiting again, this time with an anti-ageist approach. An advertisement in a South
London newspaper, which covers MI5’s Thames House HQ, targeted older people
looking for jobs as administrative assistants with MIS at a salary of £11,228. It said: Ir,
an era of 25 year- old whizkids, it is natural to feel a few grey hairs do not enhance
your employment prospects. Natural but wrong. But it cautioned: Try to avoid telling
too many people about your application because discretion is a serious part of
working for the security service.’ GCHQ entered the 1997 "Human Resources
Excellence Awards" and were successful in winning an Award for Significant HR
Achievement Under Difficult Circumstances. As GCHQ has become more
market-facing and business-led, HR has played a key role in driving and supporting
change. A number of personnel reforms have taken place under the umbrella of "The
People Programme" which is underpinned by the GCHQ core competency framework.

► RUSSIA - FOREIGN INTELLIGENCE SERVICE 'COMMENTS^

Yuriy Kobaladze head of the public and media relations bureau of the Russian Foreign Intelligence
service was recently interviewed on Russian Radio. Points of interest to ENIGMA readers are
detailed.

(Q) Over the past few years, since the end of the Cold War, you have repeatedly said
that industrial espionage is playing an important role.

(A) I would not like to single out industrial espionage. Everyone knows we have the
Foreign Intelligence Service and it continues to operate. But I have not heard of
Paris, Washington or London disbanding their special services. On the contrary, we
have official statements which show that, following the disappearance of the Soviet
Union from the political map, the interests in Russia and other CIS countries has not
decreased. We are not doing anything in London, Washington or Paris that the
British, Americans or the French would not do in Moscow

(O) What other countries are operating against Russia?

(A) The number of countries engaged in intensive operations in Russia had increased
and included Iran, China and North Korea. Most enterprises in which foreign secret
services show interest are situated in the Moscow Region.

(Q) Is Russian intelligence stepping up its activities?

(A) No, it is not. Our major task is now restricted to gathering information about the
countries where we operate, without interfering in their internal affairs.

(Q) When the FIS was pari of the KGB, it was all called a power-wielding body. But
is this the case today?

(A) No, we are a special service, but we are not a power wielding body. Moreover, I
would like to emphasize that we are not a law-enforcement agency. We do not catch
anyone, neither have we anyone under surveillance. We operate abroad and we have
no commandos capable of carrying out tasks that the former KGB used to carry out.

► VATICAN CITY - MJKTfKR SHEDS LIGHT ON SPIES IN THE VATIC AN
The Vatican City long time suspect of a Number Station operation was thrust into the
spotlight recently when Swiss guard Vice-Corporal Cedric Tomay ,23, was accused of
killing Colonel Alois Eslermann, 44, and his wife Gladys, 49. Tornay’s suicide note
contained the ambiguous remark that "they" had forced him to commit the murder. A
report in 'Berliner Kurier’ claims that Estermann, was a Stasi informer recruited
in 1979 in Berne. From 1980 he was in the Vatican service, at the same time
delivering information to German spymaster Markus Wolf. A spokesman for the
former Stasi archives would only confirm that the East Germans had an agent in the
Vatican between 1981 and 1984. His codename was "Werder".

Alarmed by the appointment of a Polish pontif and his support for the Polish
Solidarity trade union, the Warsaw Pact intelligence community targeted the Vatican.
Polish, Hungarian, Czechoslovakian & Lithuanian priests were studied for their
blackmail potential. Bulgarians were implicated in the plot to kill the Pope on May 13,
1981’, they were connected with the Rome offices of Eastern European airlines.
Passenger lists yielded useful information about Vatican employees who were en
route to the East, and some employees acted as links between Vatican informers and
their spy centres.

The intensity of the spying suggests that all parts of the Vatican were interesting for
Eastern intelligence services: the bank (known as the Institute for Religious Works),
the various secretariats the secret archives and the Swiss Guard.

The close cooperation between the CIA and the Vatican during the 1980s stirred the
interest of the Soviet-bloc spy agencies. The Pope was given access to satellite
information, electronic eavesdropping reports and summaries of policy discussions at
the White House, the State Department and the CIA. Between 1981 and 1988
General Vernon Walters, a former CIA deputy director, was received seven times by
the Pope for personal briefings. Vatican officials received classified information from
the United States on Poland, Lithuania, Central America, on terrorism, on Chinese
military power, on American and Soviet nuclear weaponry, and even on the nuclear
ambitions of Pakistan (in the news again recently). The flow of information was
naturally of some fascination to Moscow and its allies.

> NATO - HUNGARY / CZECH REPUBL I C / PQIJVND : A report in the German news
magazine "Spiegel" (Mirror) reported that the countries joining NATO -
Hungaty/Czech Republic & Poland would still continue to send agents to other
NATO partner countries. Military strengths will remain of particular interest, the
report stated. The local "Mitteldeutsche Zeitung" reported that the Spiegel’s story had
been confirmed by German government officials in Bonn, but Radio Budapest’s
German service reported that the allegations were denied by the Bonn government.

GERMANY - COMPUTER CONTAINING SECRETS GOES MISS IMG A crisis in
the German state of Thuringia errupted when the Ministry of Interior relocated and
lost two computers. The hard discs contained secret information from the
Verfassungsschutz about Scientology, "V-men", and others. Officers of the Ministry
should not have stored such information on computer disc. The trouble did not end
there, when an unknown person entered the building and stole some documents. In
the United States an unknown person entered the office of Secretaiy of State
Madeleine Albright, leaving with documents. The FBI are investigating.

fc- AUSTRALIA - UNITED STATES / AUSTRALIA SIGN MEW TREATY - The
United States and Australia have signed a 10 - year renewal on the joint use of a spy
facility in the Australian Outback. Foreign Minister Alexander Downer and U.S.
Ambassador Genta Hawkins Holmes signed the renewal of the Pine gap treaty,
originally signed in in 1967. Defence Minister Ian McLachlan said, This extension
reflects the value of the Pine gap facility." It was used during the 1991 Gulf War to
monitor Iraqi missile launches and troop movements.

£ Acknowledgements for this section: Reuters, Wired Ventures, Inc. Mail on Sunday Newspaper,
Intercepts via ’D\ BBC Radio 2, Simon Winchester/Island Magazine, Mike in Kent, Paul in London,
Simon Davies/Daily Telegraph Newspaper, Ken in Doncaster, Jerusalem Post Newspaper, Arabic
News. Juan O.Tamayo/Miami Herald, Washington Past, Andreas in Germany, Roger Boyes in Bonn.

PI .BA SE SEND YOUR NEWS REPOR TS TO OUR USUAL ADDRESS.

THANK YOU

by M.G.

Some notes on Direction Finding

W@ are still intending to produce practical instructions for a
reasonably reliable DF aerial and goniometer- However, until
we get ENIGMA HQ's own DF facilities set up and working, we've
decided to withhold these- In the meantime, this short
article is intended to introduce the subject to those of you
with little knowledge of professional DF systems.

Accurate direction finding on HF is no easy matter. This is
why Non-Direc tional Beacons, Decca (used for aeronautical -
and maritime - navigation), and Datatrack (used by security
companies etc.) operate on LF/MF. As we all know HF is
subject to all kinds of propagations! effects - which never
remain constant: day/night effects, multiple path, sun-spot
cycle, fading, phase distortion etc- Without sophisticated DF

facilities - and, at times, even with them - unreliable
results and low accuracy are to be expected.

Several of you have referred to using commercially available
“HF loops**. Little success can be achieved with these,
especially above about 3-5MHz at night, or 4-7MHz during the
day (very approximate - depends an conditions). It's not
worth attempting to DF a weak, fading station, at any time. A
strong AM or Morse station with steady carrier has a higher
degree of success. A sharp null is required* which

corresponds to the ’'crossing'’ in the figure 8 polar diagram.
Single loops of this kind rarely provide sharp enough nulls on
HF, leading to a very wide angle aperture. Ideally we need
better than 2 degrees. Loops may provide 10 degrees at best.
A sense aerial is also required to determine the "sense" i.e*
to eliminate the ambiguous reciprocal bearing associated with
a loop's second null. The combination of the two aerials

produces a cardioid polar diagram, however, its null is not as
sharp as in the “figure of 8”, so the sense aerial needs to be
switched out when not needed. In Britain, where most Numbers
stations emanate from Continental Europe, a sense, aerial is
less often needed as we know that most of our DF work involves
the 45-115deg sector, and we can safely ignore reciprocal
bearings. However, in Central Europe 360deg coverage is
essential and a sense aerial absolutely necessary.

One bearing doesn't make a “fix", of course. Two or preferably
three or more bearings are required, with long base lines
between monitoring sites - hundreds of miles/km when the
target transmitter is a comparable distance away. Narrow and
wide intercept angles give increasingly poor fixes. Ideally,
for minimum error an intercept angle between two sites needs
to be within approx. 65-115 degrees. Co-ordination between
monitors is also needed. Known probable sites in the target
zone can then be eliminated (or not 1 ) , and unknown sites
sought out by various means. Final confirmation comes from
visiting the suspect site with a field strength meter or
crystal set*

Pfbfessional monitoring agencies at their fixed sites use
three main types of DF aerial, all non-rotatabl e :

1. Adcock (& variants) - used extensively in WWII. 360deg
coverage. Good results on small land area. An important
variant is the CDAA (circularly-disposed antenna array)
360deg„ More land needed. Used with dual diversity receivers
and automated (fast motor-driven ) goniometers. Accurate to
<ldeg„ Can respond to "burst' 1 transmissions , and can be
adapted to plot and store real-time spectrum use. Widely used
by monitoring agencies. Used by NSA at Menwith Hill, CSO at
Irton Moor etc., DTI at Baldock (2), and until recently by the
Foreign Office at Poundon .

3. Phased loop array . A series of fixed crossed loops aligned
in a particular direction. About HOdeg coverage. Two at
right angles - 360deg« Examples can be seen at RN Forest
Moor, RN Southwick etc., and until recently at HMGCC Poundon.

4. HF interferometer - about iiOdeg coverage. High
resolution. Needs a large long strip of land — a mile or so.
The one at CSOS Cheadle is aligned N~S providing optimum
coverage of Europe.

All these aerials, being fixed, are rotated electronically by
goniometers - ang ie-measuring/phase-changing devices. The
basic type, as used with an Adcock, consists of two fixed
coils at right angles to each other — with a central,
manual I y-rotated search coil attached to a dial calibrated in
degrees - which are aligned with True North.

The only practical HF DF system we can use is the Adcock-
derived aerial and goniometer. This consists of four vertical
aperiodic (untuned) elements - rigid rods or wire attached to
rJL gic I wooden poles. Each element is mounted at the corner of
a square - about 4m sides or more. Four equal lengths of
50ohm coaxial cable are used to link each element with the two
stator coils of the gonio, their outer sheaths being attached
to earth spikes at the base of each element, which may be
joined together underground with bare wire. Throughout, the
only critical consideration is the symmetry. As far as
possible, everything must be symmetrical - square, feeder
lengths, earthing, gonio coils. The square need not be
aligned with True North, as the gonio dial can be calibrated
by using bearings of known (strong) transmissions .

%**%%%***% t **** t***t******k*%*%t ************ t **********

Many thanks to all of you who have written in. If your
contributions haven't been included in this issue, this
doesn't mean that they have been ignored. They will be made
use of in the future. Special thanks go to Paul (for his
excellent embassy and intelligence reports), Andreas, Hans-
Friedrich, Guy (for the usual'.), Vassily, Rob, Richard, and
the member who sent in the RIMNET details, and many more whose
names escape me. . .

oar ODDS AND ENDS

Some things just don’t slot into a particular section so vie will cover them on this special page.

© NEXT SOUTH-PAST MEETING - Following a successful meeting held on WED March 1 1th which
was described as pleasant, informative and stimulating, a further meeting will be held in September.
Remember, all are welcome. If you are interested please drop a note to the ENIGMA office and
Mike (VC) will contact you or you can email him at < enigma.box@centrenet.co.uk>

The venue will move around in order to attract more members. Next meeting details are: WED 9th
SEPTEMBER 1998 - 7.30 PM, "The Rubbing House" public house (Nr Epsom Downs Racetrack,
well sign-posted) Off M25 at Junction 8 onto A217, London bound (easily found at the junction of 3
roads well in the dear) Easy access from M25, M23, M3, A3 and many minor roads.

It is planned to hold two meetings per year.

® SHQRTWAVF MAGAZINE - The British news stand magazine ’Shortwave Magazine’ have agreed
for ENIGMA to carry a Numbers Page every other month, the first was published in April. We
would like to welcome new readers to ENIGMA who responded to the feature. The Numbers page
will aim to promote the subject and carries the ENIGMA mailing address.

@ BACK ISSUES OF ENiGMA - We had an excellent response (thank you) to the rs-print of back
issues. We now have very few of the lower (1-10) issues left. In future we hope to be able to offer
the previous 3 issues (e g. 12, 13, 14, at present) for purchase. The publication of our ENIGMA
Booklet should help to overcome the problems of searching for information through .numerous
back copies.

© INTERNET COVERAGE - We mentioned in the last issue that Mike (VC) spends a great deal of
time searching and sifting through Internet material from a wide variety of sources. The Internet has
developed at an alarming rate in recent years. We would like to ask readers (connected up or not)
what information/addresses/coverage they would like. In recent issues we have mentioned sites of
interest. Would readers like to have more sites/subjects listed or less? Or are we telling you about
things which are of interest or not? Please let us know.

Just a note to remind readers that we are still very

interested in receiving any recordings of inactive stations and also any information about Number
Stations of an historical nature. We are continuing to build up a picture of the evolution of certain
stations. All information appreciated.

® CORRECTIONS TO ISSUE 14 -

Simon Mason Writes - Page 39 Para. 4. The reference to jamming of Phonetic Alphabet stations
incorrectly referred to (E15) this should have read (E10). Typo error by ENIGMA - not Simon.

News Round Up - Page 44. The reference to "Agents for Peace Call For Justice" Initiative Group" -
the address omitted the city of Bonn. Full address is: Klaus von Raussendorff, An der Nesselburg
81, Bonn 53179, GERMANY.

Radio in the Gehten Organisation - Page 59. Para. 2. The reference to an "emergency receiver was
tuned to prearranged wavelengths and hidden amongst the aerials of Radio Free Europe”. Should,
of course, have read "an emergency transmitter*. The usual abbreviation for Organisation Gehlen is
not “Org" but OG. The reference to Wittenberg should have read Wittenberge, a northern town.

MESSAGE FOR ’D ’ Piease continue to supply ’Intelligence Monitor* pages from JIR - plus any back
copies. Thanks for all other information. Still awaiting contact address. We cannot publish certain
information due to lack of verification.

E3 (Lincolnshire Poacher) Headers sent over period 1.5.95 to 30.11.95

Message Period

1.5.95

15.5.95

1.6.95

15.6.95

1.7.95

15.7.95

1.8.95

15.8.95

1.9.95

15.9.95

1.10.95 ,

15.10.95

1.11.95

15.11.95

Schedule
A B

79891

84231

61259

76525

61015

04454

44333

33238

00768

90792

86656

63467

16957

79171

00283

79127

97581

79575

65297

07982

47630

24378

42613

88364

60075

64593

28773

44173

59922

30253

66960

39694

17341

02928

26795

07601

75086

02044

90335

39715

26818

38418

64793

•36695 67894

64793

25602

£3047

17032

18713

13308 55542

46967 27905

65342

34420

76728

76750

73424

41704

01609

05396

02441

09375

69701

32966

78750

12729

43479

91950

80368

45694

46427

99265

90752

99371

40984

01090

81913

51814

82001

20309

50974

04257

65182

92099

44808

04860

52547

73494

21769

13053

05991

53768

26764

51478

88997

61614

23092
72685
00374
04766 .
01362/

26225

65742

63742

01362

83318

01362

99424

13805

29246

31180

33414

96270

77576

42324, 57330
17438

93318 33214

70775 78417

' 78524
61232 99424

00617 06095

68013 19347

05285

49656

21224

51404

4370 2

84017

49326

68697

20196

9525 5

01966

864 76

74294

28275

31648

49639

21267

51423

43786

49394

68540

20086

95222

01885

8648 3

74219

49589

21263

43790

99364

95127

01954

86471

74399

The above sample has been chosen as it shows maximum use of the multiple-message schedules:

D H & I. Certain significant features have been underlined. Until recently E3 headers were
believed to be random - they are not entirely so. Note the same headers being repeated in
D, H & I, e.g. H2 msg. 01362, 2nd of the 15.6 m.p., was repeated for the whole of the 1.7 m.p.
and again for the 1st of the 1.8 m.p. Multiple I messages carry the same first 2 or 3 header
digits, yet this does not apply to D & H. More significant still is that some headers begin with
the same 3 digits exactly a year later. Two cases were noted when the second came exactly a
month after the first. 58009 occurred in the 2nd August m.p. of 1996 and 1997. These patterns
were mainly observed between 96/97, but also 97/98, yet not before 1996. All this refers to G
headers,. P -.nothing significant. K - 1.5.95 & 15.5.95 both start 767** , and 15.2.97 & 15.6.97
wete both 03022 - coincidence? C - 205** was noted 15.7.97 & 1.7.96; 55135 on 15.3.97 & 15.3.98

- no coincidence. 72371 on 15.2.95 & 15.3.95. E - twice 1st 3 digits repeat, probably coincid-
ence. A - 007**, noted 1.9.95 & 1.9.96, 907** : 15.9.95 & 15.9.96, 267** : 1.12.95/96, 634** ;
is in QS/Qfi 169** • 1.11.95/96, 758** : 15.12.95/96, Others don’t fit the 1 year rule: 131- *

15*8 96/ 1 3 96 *188** 1,7. 96/15 .2.97, 443** 1.8.95/15.1.98, 729** 13. 7.96/1.3.98/1.4.95, 866*-*

6?«/ . i!«/i. 0.96 (the last also’with a 1 year ’fit’). As G 96/97 and 97/98 and A 95/96 headers are related, could A
h^ihada task which was later taken over by G. If so, this would make transmissions even more difficult to follow.

Thanks go to Andreas for his meticulous long-term monitoring of E3, and these new discoveries.

m.p.

13 14

1.5

£2.589

15.5

21263

1.6

15.6

43790

1.7

15.7

15.8

99364

1.9

95127 . -

15.9

01954 dl891

1.10

86471 86447

74399 74345

i.ii

15.11

86439

cont.

Internet Archive Audio

Featured

Top

Images

Featured

Top

Software

Featured

Top

Texts

Featured

Top

Video

Featured

Top

Mobile Apps

Browser Extensions

Archive-It Subscription

Save Page Now

Full text of "ENIGMA newsletters 1993-2000"

See other formats